kgretzky/evilginx2 · error

missing `credentials` section

Error message

missing `credentials` section

What it means

This error is thrown by the phishlet loader during Validate() when the phishlet YAML config has no top-level `credentials` section, or it is explicitly set to null. Evilginx3 phishlets must define `credentials` (with username/password sub-sections) so the framework knows which form fields to capture and inject during a phishing session. The nil-check on fp.Credentials fails before any sub-fields are inspected.

Source

Thrown at core/phishlet.go:384

		/*
			if customParams != nil {
				p.customParams = *customParams
			} else {
				for _, param := range *fp.Params {
					p.customParams[param.Name] = param.Default
				}
			}*/
	}

	if fp.ProxyHosts == nil {
		return fmt.Errorf("missing `proxy_hosts` section")
	}
	if fp.AuthTokens == nil {
		return fmt.Errorf("missing `auth_tokens` section")
	}
	if fp.Credentials == nil {
		return fmt.Errorf("missing `credentials` section")
	}
	if fp.Credentials.Username == nil {
		return fmt.Errorf("credentials: missing `username` section")
	}
	if fp.Credentials.Password == nil {
		return fmt.Errorf("credentials: missing `password` section")
	}
	if fp.LoginItem == nil {
		return fmt.Errorf("missing `login` section")
	}

	for _, ph := range *fp.ProxyHosts {
		if ph.PhishSub == nil {
			return fmt.Errorf("proxy_hosts: missing `phish_sub` field")
		}
		if ph.OrigSub == nil {
			return fmt.Errorf("proxy_hosts: missing `orig_sub` field")
		}

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a top-level `credentials:` section to the phishlet YAML
2. Add `username:` and `password:` sub-sections under it with at least a `key:` form input each
3. Verify indentation with a YAML linter so credentials binds to the top-level struct

Example fix

# before
proxy_hosts:
  - phish_sub: login
    orig_sub: login
    domain: example.com
# after
proxy_hosts:
  - phish_sub: login
    orig_sub: login
    domain: example.com
credentials:
  username:
    key: username
    search: any
  password:
    key: password
    search: any

data, _ := ioutil.ReadFile(phishletPath)
var fp struct {
	Credentials *struct{} `yaml:"credentials"`
}
yaml.Unmarshal(data, &fp)
if fp.Credentials == nil {
	return errors.New("phishlet must define a top-level `credentials:` section")
}

func hasCredentials(fp *PhishletConfig) bool {
	return fp != nil && fp.Credentials != nil
}

err := cfg.AddPhishlet("local", name)
if err != nil {
	if strings.Contains(err.Error(), "missing `credentials` section") {
		log.Fatalf("phishlet %s: add a credentials block with username and password sub-sections", name)
	}
	return err
}

When it happens

Trigger: Loading a phishlet (config add phishlet / site load) whose YAML omits the `credentials:` block entirely, or contains only `credentials:` with no mapping beneath it, causing fp.Credentials to remain nil.

Common situations: Hand-writing a phishlet from scratch and forgetting the credentials block; copying only the proxy_hosts part of a template; a YAML indentation mistake that nests credentials under another key so it never binds to the struct.

Related errors

• credentials: missing `username` section
• credentials: missing `password` section
• missing `login` section
• proxy_hosts: missing `phish_sub` field
• proxy_hosts: missing `orig_sub` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/786043cff800e565. Report an issue: GitHub.