kgretzky/evilginx2 · error

intercept: `domain` field cannot be empty

Error message

intercept: `domain` field cannot be empty

What it means

This error is thrown during phishlet YAML validation when an `intercept` configuration block defines a `domain` field that is present but set to an empty string. The library requires every intercept entry to declare the subdomain whose responses it applies to, so an empty value is rejected just like a missing one. It is raised by the phishlet parser in core/phishlet.go while compiling the phishlet config.

Source

Thrown at core/phishlet.go:497

			}
			for n := range *js.TriggerPaths {
				(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])
			}
			err := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))
			if err != nil {
				return err
			}
		}
	}
	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {
			var err error
			var body, mime string
			if ic.Domain == nil {
				return fmt.Errorf("intercept: missing `domain` field")
			}
			if *ic.Domain == "" {
				return fmt.Errorf("intercept: `domain` field cannot be empty")
			}
			if ic.Path == nil {
				return fmt.Errorf("intercept: missing `path` field")
			}
			path_re, err := regexp.Compile(*ic.Path)
			if err != nil {
				return fmt.Errorf("intercept: `path` invalid regular expression: %v", err)
			}
			if ic.HttpStatus == nil {
				return fmt.Errorf("intercept: missing `http_status` field")
			}
			if ic.Body != nil {
				body = *ic.Body
			}
			if ic.Mime != nil {
				mime = *ic.Mime
			}
			err = p.addIntercept(*ic.Domain, path_re, *ic.HttpStatus, body, mime)

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Set a non-empty subdomain value in the intercept block's `domain` field (e.g. `domain: accounts`).
2. If the intercept should match any subdomain, use the wildcard value supported by the phishlet format instead of leaving it blank.
3. Remove the whole intercept block if it is not needed.

Example fix

// before (phishlet.yml)
intercept:
  - domain: ""
    path: ^/login$
// after
intercept:
  - domain: "accounts"
    path: ^/login$

for i, ic := range cfg.Intercept {
    if ic.Domain == nil {
        return fmt.Errorf("intercept[%d]: missing `domain` field", i)
    }
    if *ic.Domain == "" {
        return fmt.Errorf("intercept[%d]: `domain` field cannot be empty", i)
    }
}

func hasNonEmptyDomain(ic InterceptCfg) bool {
    return ic.Domain != nil && strings.TrimSpace(*ic.Domain) != ""
}

When it happens

Trigger: A phishlet YAML contains an intercept block like `intercept:\n - domain: ""` — the `domain` key exists (pointer non-nil) but dereferences to "".

Common situations: Hand-editing a phishlet and clearing the domain value; templating/scripted generation that leaves the field blank; copying a phishlet and forgetting to fill in the target subdomain.

Related errors

• intercept: missing `path` field
• intercept: `path` invalid regular expression: %v
• intercept: missing `http_status` field
• auth_tokens: invalid token type: %s
• auth_tokens: 'domain' not found for cookie auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/19152c20342cec6c. Report an issue: GitHub.