kgretzky/evilginx2 · error

sub_filters: missing `mimes` field

Error message

sub_filters: missing `mimes` field

What it means

Every `sub_filters` entry must list `mimes`, the response MIME types the substitution applies to. The entry's `mimes` field was nil, so validation fails. Later code dereferences `*sf.Mimes` in a range loop, so a missing list would also cause a nil dereference.

Source

Thrown at core/phishlet.go:448

		}
	}
	if !landing_set {
		p.proxyHosts[0].is_landing = true
	}

	if fp.SubFilters != nil {
		for _, sf := range *fp.SubFilters {
			if sf.Hostname == nil {
				return fmt.Errorf("sub_filters: missing `triggers_on` field")
			}
			if sf.Sub == nil {
				return fmt.Errorf("sub_filters: missing `orig_sub` field")
			}
			if sf.Domain == nil {
				return fmt.Errorf("sub_filters: missing `domain` field")
			}
			if sf.Mimes == nil {
				return fmt.Errorf("sub_filters: missing `mimes` field")
			}
			if sf.Search == nil {
				return fmt.Errorf("sub_filters: missing `search` field")
			}
			if sf.Replace == nil {
				return fmt.Errorf("sub_filters: missing `replace` field")
			}
			if sf.WithParams == nil {
				sf.WithParams = &[]string{}
			}

			for n := range *sf.Mimes {
				(*sf.Mimes)[n] = p.paramVal((*sf.Mimes)[n])
			}
			p.addSubFilter(p.paramVal(*sf.Hostname), p.paramVal(*sf.Sub), p.paramVal(*sf.Domain), *sf.Mimes, p.paramVal(*sf.Search), p.paramVal(*sf.Replace), sf.RedirectOnly, *sf.WithParams)
		}
	}
	if fp.JsInject != nil {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add `mimes: ['text/html']` (or the relevant list, e.g. text/html, application/javascript) to the entry
2. Ensure the value is a YAML list with correct indentation, since the code ranges over the slice
3. Reload the phishlet and address any next missing field reported

Example fix

// before
sub_filters:
  - triggers_on: 'auth.example.com'
    orig_sub: 'accounts'
    domain: 'example.com'
    search: 'accounts\\.example\\.com'
    replace: 'accounts.{domain}'
// after
sub_filters:
  - triggers_on: 'auth.example.com'
    orig_sub: 'accounts'
    domain: 'example.com'
    mimes: ['text/html']
    search: 'accounts\\.example\\.com'
    replace: 'accounts.{domain}'

for i, sf in enumerate(cfg.get('sub_filters') or []):
    mimes = sf.get('mimes')
    if not isinstance(mimes, list) or len(mimes) == 0:
        raise ValueError(f"sub_filters[{i}]: missing `mimes` field")

func validSubFilter(sf SubFilter) bool { return sf.Mimes != nil }

When it happens

Trigger: A `sub_filters:` entry lacks the `mimes:` key; core/phishlet.go's `if sf.Mimes == nil` check rejects the phishlet before the `for n := range *sf.Mimes` loop runs.

Common situations: Omitting mimes when writing a quick filter (many filters only need text/html); misspelling as `mime:`; a filter copied from js_inject style where the field names differ.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• sub_filters: missing `domain` field
• sub_filters: missing `search` field
• sub_filters: missing `replace` field
• sub_filters: missing `triggers_on` field
• sub_filters: missing `orig_sub` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/1aaf13fd955e7a14. Report an issue: GitHub.