kgretzky/evilginx2 · error

intercept: missing `domain` field

Error message

intercept: missing `domain` field

What it means

Each entry in the `intercept` list must define a `domain`, the host whose responses are intercepted and returned with the given body/mime. The parser found a nil `domain` field and aborts validation. Note the next check also rejects an empty string, so the field must be a non-empty hostname.

Source

Thrown at core/phishlet.go:494

			}
			for n := range *js.TriggerDomains {
				(*js.TriggerDomains)[n] = p.paramVal((*js.TriggerDomains)[n])
			}
			for n := range *js.TriggerPaths {
				(*js.TriggerPaths)[n] = p.paramVal((*js.TriggerPaths)[n])
			}
			err := p.addJsInject(*js.TriggerDomains, *js.TriggerPaths, js.TriggerParams, p.paramVal(*js.Script))
			if err != nil {
				return err
			}
		}
	}
	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {
			var err error
			var body, mime string
			if ic.Domain == nil {
				return fmt.Errorf("intercept: missing `domain` field")
			}
			if *ic.Domain == "" {
				return fmt.Errorf("intercept: `domain` field cannot be empty")
			}
			if ic.Path == nil {
				return fmt.Errorf("intercept: missing `path` field")
			}
			path_re, err := regexp.Compile(*ic.Path)
			if err != nil {
				return fmt.Errorf("intercept: `path` invalid regular expression: %v", err)
			}
			if ic.HttpStatus == nil {
				return fmt.Errorf("intercept: missing `http_status` field")
			}
			if ic.Body != nil {
				body = *ic.Body
			}
			if ic.Mime != nil {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add `domain: '<hostname>'` (e.g. `domain: 'api.example.com'`) to the intercept entry
2. Ensure the value is non-empty; an empty `domain: ''` also fails validation (empty-string check immediately after)
3. Reload and continue with the next reported field (path, then body/mime checks)

Example fix

// before
intercept:
  - path: '/health'
    body: 'ok'
    mime: 'text/plain'
// after
intercept:
  - domain: 'api.example.com'
    path: '/health'
    body: 'ok'
    mime: 'text/plain'

for i, ic in enumerate(cfg.get('intercept') or []):
    d = ic.get('domain')
    if d is None:
        raise ValueError(f"intercept[{i}]: missing `domain` field")
    if d == '':
        raise ValueError(f"intercept[{i}]: `domain` field cannot be empty")

func validIntercept(ic Intercept) bool { return ic.Domain != nil && *ic.Domain != "" }

When it happens

Trigger: A `intercept:` entry in the phishlet YAML omits the `domain:` key; core/phishlet.go's `if ic.Domain == nil` check fires while iterating fp.Intercept.

Common situations: Writing an intercept block with only path/body/mime; typo like `hostname:`; YAML indentation error that left domain on a sibling node; copying from docs that used a different field order.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• sub_filters: missing `domain` field
• sub_filters: missing `mimes` field
• sub_filters: missing `search` field
• sub_filters: missing `replace` field
• js_inject: missing `trigger_domains` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/19ece51d4897703a. Report an issue: GitHub.