What causes "force_post: missing search `key` field" in kgretzky/evilginx2?

Add the missing `key:` field to each force_post search entry

force_post: missing search `key` field

Error message

force_post: missing search `key` field

What it means

Thrown when an optional `search` entry inside a force_post operation lacks the `key` field. Each search entry needs both a `key` (compiled into a regexp after param substitution) and a `search` regexp; without `key` the entry is meaningless and validation fails. The key identifies which POST parameter is being searched.

Source

Thrown at core/phishlet.go:719

			}
			if op.Type == nil || *op.Type != "post" {
				return fmt.Errorf("force_post: unknown type - only 'post' is currently supported")
			}
			if op.Force == nil || len(*op.Force) == 0 {
				return fmt.Errorf("force_post: missing or empty `force` field")
			}

			fpf := ForcePost{}
			fpf.path, err = regexp.Compile(p.paramVal(*op.Path))
			if err != nil {
				return err
			}
			fpf.tp = *op.Type

			if op.Search != nil {
				for _, op_s := range *op.Search {
					if op_s.Key == nil {
						return fmt.Errorf("force_post: missing search `key` field")
					}
					if op_s.Search == nil {
						return fmt.Errorf("force_post: missing search `search` field")
					}

					f_s := ForcePostSearch{}
					f_s.key, err = regexp.Compile(p.paramVal(*op_s.Key))
					if err != nil {
						return err
					}
					f_s.search, err = regexp.Compile(p.paramVal(*op_s.Search))
					if err != nil {
						return err
					}
					fpf.search = append(fpf.search, f_s)
				}
			}
			for _, op_f := range *op.Force {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add the missing `key:` field to each force_post search entry
Fix key-name typos to match the force_post search schema (key + search)
Remove incomplete search entries if they are not needed

Example fix

# before
force_post:
  - path: '/login'
    type: post
    search:
      - search: 'password'
# after
force_post:
  - path: '/login'
    type: post
    search:
      - key: 'password'
        search: 'password'

Defensive patterns

Strategy: validation

Validate before calling

for _, op := range forcePosts {
    if op.Search == nil { continue }
    for j, s := range *op.Search {
        if s.Key == nil {
            return fmt.Errorf("force_post search[%d]: `key` is required", j)
        }
    }
}

Type guard

func searchHasKey(s ForcePostSearch) bool { return s.Key != nil }

Prevention

Ensure every search entry has both `key` and `search` fields
Do not mix field names from regex_sub/subfilters into force_post search
Lint phishlet YAML before deployment
Remove unfinished search entries before saving

When it happens

Trigger: Phishlet YAML has a force_post `search:` list item without a `key:` key, e.g. only `search:` and `regexp`-style fields are present; validation via p.Validate().

Common situations: Typos (`name:` instead of `key:`); copying search blocks from regex_sub or subfilters that use different field names; partial edits leaving half-finished search entries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/17af4cea79354426. Report an issue: GitHub.