What causes "force_post: missing search `search` field" in kgretzky/evilginx2?

Add a valid `search:` regexp to each force_post search entry

force_post: missing search `search` field

Error message

force_post: missing search `search` field

What it means

Thrown when a force_post `search` entry lacks the `search` field. The `search` value is a regexp (compiled with p.paramVal substitution) used to locate content within the POST parameter named by `key`; without it the search entry is invalid and the phishlet fails validation.

Source

Thrown at core/phishlet.go:722

			}
			if op.Force == nil || len(*op.Force) == 0 {
				return fmt.Errorf("force_post: missing or empty `force` field")
			}

			fpf := ForcePost{}
			fpf.path, err = regexp.Compile(p.paramVal(*op.Path))
			if err != nil {
				return err
			}
			fpf.tp = *op.Type

			if op.Search != nil {
				for _, op_s := range *op.Search {
					if op_s.Key == nil {
						return fmt.Errorf("force_post: missing search `key` field")
					}
					if op_s.Search == nil {
						return fmt.Errorf("force_post: missing search `search` field")
					}

					f_s := ForcePostSearch{}
					f_s.key, err = regexp.Compile(p.paramVal(*op_s.Key))
					if err != nil {
						return err
					}
					f_s.search, err = regexp.Compile(p.paramVal(*op_s.Search))
					if err != nil {
						return err
					}
					fpf.search = append(fpf.search, f_s)
				}
			}
			for _, op_f := range *op.Force {
				if op_f.Key == nil {
					return fmt.Errorf("force_post: missing force `key` field")
				}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a valid `search:` regexp to each force_post search entry
Correct field-name typos to `search`
Delete the empty search entry if the search is unnecessary

Example fix

# before
search:
  - key: 'username'
# after
search:
  - key: 'username'
    search: '[^&]*'

Defensive patterns

Strategy: validation

Validate before calling

for _, op := range forcePosts {
    if op.Search == nil { continue }
    for j, s := range *op.Search {
        if s.Search == nil {
            return fmt.Errorf("force_post search[%d]: `search` regexp is required", j)
        }
        if _, err := regexp.Compile(*s.Search); err != nil {
            return fmt.Errorf("force_post search[%d]: invalid regexp: %v", j, err)
        }
    }
}

Type guard

func searchHasRegexp(s ForcePostSearch) bool { return s.Search != nil }

Prevention

Pair every search `key` with a `search` regexp
Test regexps before adding them to the phishlet
Avoid renaming the field to match/regex - it must be `search`
Validate the full phishlet after each edit

When it happens

Trigger: Phishlet YAML has a force_post `search:` list item with `key:` set but no `search:` field; phishlet load/validate is executed.

Common situations: Half-written search rules; field-name typos (`match:`, `regex:` instead of `search:`); deleting the regexp line while keeping the entry; mixing schemas from other phishlet directives like regex_sub.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/86a6cde4fac2d4f1. Report an issue: GitHub.