kgretzky/evilginx2 · error

sub_filters: missing `domain` field

Error message

sub_filters: missing `domain` field

What it means

Each `sub_filters` entry requires a `domain`, the registrable domain whose subdomain strings are rewritten. The parser found a nil `domain` field and refuses to register the filter. This is the base domain used when substituting `orig_sub.domain` with the phishing host.

Source

Thrown at core/phishlet.go:445

		if ph.is_landing {
			landing_set = true
			break
		}
	}
	if !landing_set {
		p.proxyHosts[0].is_landing = true
	}

	if fp.SubFilters != nil {
		for _, sf := range *fp.SubFilters {
			if sf.Hostname == nil {
				return fmt.Errorf("sub_filters: missing `triggers_on` field")
			}
			if sf.Sub == nil {
				return fmt.Errorf("sub_filters: missing `orig_sub` field")
			}
			if sf.Domain == nil {
				return fmt.Errorf("sub_filters: missing `domain` field")
			}
			if sf.Mimes == nil {
				return fmt.Errorf("sub_filters: missing `mimes` field")
			}
			if sf.Search == nil {
				return fmt.Errorf("sub_filters: missing `search` field")
			}
			if sf.Replace == nil {
				return fmt.Errorf("sub_filters: missing `replace` field")
			}
			if sf.WithParams == nil {
				sf.WithParams = &[]string{}
			}

			for n := range *sf.Mimes {
				(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])
			}
			p.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add `domain: <registrable-domain>` (e.g. `domain: 'example.com'`) to the sub_filters entry
2. Confirm the value is the registrable base domain without the subdomain prefix
3. Check YAML indentation so `domain:` belongs to the same list item as `triggers_on` and `orig_sub`
4. Reload and continue fixing any subsequent reported fields

Example fix

// before
sub_filters:
  - triggers_on: 'auth.example.com'
    orig_sub: 'accounts'
    mimes: ['text/html']
// after
sub_filters:
  - triggers_on: 'auth.example.com'
    orig_sub: 'accounts'
    domain: 'example.com'
    mimes: ['text/html']

for i, sf in enumerate(cfg.get('sub_filters') or []):
    if sf.get('domain') is None:
        raise ValueError(f"sub_filters[{i}]: missing `domain` field")

func validSubFilter(sf SubFilter) bool { return sf.Domain != nil }

When it happens

Trigger: A `sub_filters:` list item in the phishlet YAML omits `domain:`; core/phishlet.go's nil check `if sf.Domain == nil` fires during validation.

Common situations: Copying a filter block and deleting the domain line; assuming domain is inherited from `triggers_on`; YAML indentation mistake that dropped the key into a sibling map.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• sub_filters: missing `mimes` field
• sub_filters: missing `search` field
• sub_filters: missing `replace` field
• sub_filters: missing `triggers_on` field
• sub_filters: missing `orig_sub` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/a8135cbb0ee5bc2a. Report an issue: GitHub.