What causes "login: missing `path` field" in kgretzky/evilginx2?

Add `path: /login` (the real login URL path of the target site) under the `login:` section.

login: missing `path` field

Error message

login: missing `path` field

What it means

The `login` section of a phishlet must define a `path` field pointing at the URL path of the login page. When `login.path` is absent (nil), validation stops with this error before any path matching is configured.

Source

Thrown at core/phishlet.go:639

		return fmt.Errorf("credentials: %v", err)
	}

	p.username.tp = fp.Credentials.Username.Type
	if p.username.tp == "" {
		p.username.tp = "post"
	}
	p.password.tp = fp.Credentials.Password.Type
	if p.password.tp == "" {
		p.password.tp = "post"
	}
	p.username.key_s = p.paramVal(*fp.Credentials.Username.Key)
	p.password.key_s = p.paramVal(*fp.Credentials.Password.Key)

	if fp.LoginItem.Domain == nil {
		return fmt.Errorf("login: missing `domain` field")
	}
	if fp.LoginItem.Path == nil {
		return fmt.Errorf("login: missing `path` field")
	}
	p.login.domain = p.paramVal(*fp.LoginItem.Domain)
	if p.login.domain == "" {
		return fmt.Errorf("login: `domain` field cannot be empty")
	}
	login_domain_ok := false
	for _, h := range p.proxyHosts {
		var check_host string
		if h.orig_subdomain != "" {
			check_host = h.orig_subdomain + "."
		}
		check_host += h.domain
		if strings.ToLower(check_host) == strings.ToLower(p.login.domain) {
			login_domain_ok = true
			break
		}
	}
	if !login_domain_ok {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add `path: /login` (the real login URL path of the target site) under the `login:` section.
Verify the path matches the actual form page; subfilters only trigger on matching paths.
Keep quoting in YAML if the path contains special characters.
Reload and address the next validation error if any.

Example fix

// before
login:
  domain: accounts.example.com
// after
login:
  domain: accounts.example.com
  path: /signin

Defensive patterns

Strategy: validation

Validate before calling

if pl.Login == nil || pl.Login.Path == nil || pl.Login.Path == "" {
    return errors.New("phishlet: login.path is required (e.g. /login)")
}

Type guard

func loginPathSet(l *LoginItem) bool { return l != nil && l.Path != nil && *l.Path != "" }

Try / catch

if err := pl.Load(cfg); err != nil {
    if strings.Contains(err.Error(), "missing `path`") {
        log.Printf("add login.path to %s", pl.Name)
    }
}

Prevention

Verify the target's real login URL and put its path in login.path.
Keep domain and path adjacent in the login block so one is not forgotten.
Schema-validate phishlet YAML files.
Re-load phishlets after every edit.

When it happens

Trigger: Loading a phishlet YAML where the `login:` mapping has `domain` but no `path` key (or neither, with domain checked first).

Common situations: Truncated phishlet files; authors assuming path is optional; migrating from formats where the login URL was derived differently.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/606228fe79690497. Report an issue: GitHub.