kgretzky/evilginx2 · error

intercept: missing `http_status` field

Error message

intercept: missing `http_status` field

What it means

This error is thrown when validating a phishlet's `intercept` block: `domain` and `path` are valid, but the required `http_status` field is missing. Each intercept entry must declare the HTTP status code to serve for matching responses. The phishlet fails to load until it is added.

Source

Thrown at core/phishlet.go:507

	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {
			var err error
			var body, mime string
			if ic.Domain == nil {
				return fmt.Errorf("intercept: missing `domain` field")
			}
			if *ic.Domain == "" {
				return fmt.Errorf("intercept: `domain` field cannot be empty")
			}
			if ic.Path == nil {
				return fmt.Errorf("intercept: missing `path` field")
			}
			path_re, err := regexp.Compile(*ic.Path)
			if err != nil {
				return fmt.Errorf("intercept: `path` invalid regular expression: %v", err)
			}
			if ic.HttpStatus == nil {
				return fmt.Errorf("intercept: missing `http_status` field")
			}
			if ic.Body != nil {
				body = *ic.Body
			}
			if ic.Mime != nil {
				mime = *ic.Mime
			}
			err = p.addIntercept(*ic.Domain, path_re, *ic.HttpStatus, body, mime)
			if err != nil {
				return err
			}
		}
	}
	for _, at := range *fp.AuthTokens {
		ttype := "cookie"
		if at.Type != nil {
			ttype = *at.Type
		}

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add an `http_status` field with an integer status code to the intercept block (commonly `http_status: 302`).
2. Cross-check the intercept block against a working example phishlet to confirm all required fields (domain, path, http_status).
3. Ensure YAML indentation places `http_status` under the same list item as `domain` and `path`.

Example fix

// before (phishlet.yml)
intercept:
  - domain: accounts
    path: ^/login$
// after
intercept:
  - domain: accounts
    path: ^/login$
    http_status: 302

for i, ic := range cfg.Intercept {
    if ic.HttpStatus == nil {
        return fmt.Errorf("intercept[%d]: missing `http_status` field", i)
    }
}

func hasHttpStatus(ic InterceptCfg) bool {
    return ic.HttpStatus != nil && *ic.HttpStatus >= 100 && *ic.HttpStatus < 600
}

When it happens

Trigger: An intercept block defines `domain` and `path` but omits the `http_status` key, e.g. an entry with only `domain` and `path` lines.

Common situations: Partially completed phishlet; deleting the status line while editing; using an old phishlet format example that lacks this field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• intercept: `domain` field cannot be empty
• intercept: missing `path` field
• intercept: `path` invalid regular expression: %v
• auth_tokens: invalid token type: %s
• auth_tokens: 'domain' not found for cookie auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/1533fa1ab115fa04. Report an issue: GitHub.