kgretzky/evilginx2 · error

edit: lure hostname must end with the base domain '%s'

Error message

edit: lure hostname must end with the base domain '%s'

What it means

Validation error for `lures edit <id> hostname <val>`: the new hostname must equal the configured base domain (t.cfg.general.Domain) or be a subdomain ending with '.'+baseDomain. This keeps lure hostnames inside domains covered by the phishlet/proxy configuration so TLS certificates can be issued.

Source

Thrown at core/terminal.go:922

			if pn == 4 {
				l_id, err := strconv.Atoi(strings.TrimSpace(args[1]))
				if err != nil {
					return fmt.Errorf("edit: %v", err)
				}
				l, err := t.cfg.GetLure(l_id)
				if err != nil {
					return fmt.Errorf("edit: %v", err)
				}
				val := args[3]
				do_update := false

				switch args[2] {
				case "hostname":
					if val != "" {
						val = strings.ToLower(val)

						if val != t.cfg.general.Domain && !strings.HasSuffix(val, "."+t.cfg.general.Domain) {
							return fmt.Errorf("edit: lure hostname must end with the base domain '%s'", t.cfg.general.Domain)
						}
						host_re := regexp.MustCompile(`^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$`)
						if !host_re.MatchString(val) {
							return fmt.Errorf("edit: invalid hostname")
						}

						l.Hostname = val
						t.cfg.refreshActiveHostnames()
						t.manageCertificates(true)
					} else {
						l.Hostname = ""
					}
					do_update = true
					log.Info("hostname = '%s'", l.Hostname)
				case "path":
					if val != "" {
						u, err := url.Parse(val)
						if err != nil {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Use a hostname that is the base domain or a subdomain of it, e.g. `lures edit 2 hostname login.example.com`
2. If a different domain is intended, update `domain` in config.yaml (and the phishlet) first
3. Check the current base domain with `config domain` before editing

Example fix

// before
lures edit 2 hostname phishing.other.net
// after (base domain example.com)
lures edit 2 hostname login.phishing.example.com

val := strings.ToLower(val)
if val != domain && !strings.HasSuffix(val, "."+domain) {
	return fmt.Errorf("hostname must end with base domain %s", domain)
}

func isUnderBaseDomain(host, domain string) bool {
	host = strings.ToLower(host)
	return host == domain || strings.HasSuffix(host, "."+domain)
}

When it happens

Trigger: `lures edit 2 hostname totally-unrelated.com` where general.Domain is e.g. example.com and the value is neither example.com nor *.example.com.

Common situations: Typing a domain without its subdomain suffix, forgetting to add the subdomain to phishlet hostnames first, or having a stale/misconfigured base domain in config.yaml.

Related errors

• edit: invalid hostname
• edit: %v
• export format can only be 'text', 'csv' or 'json'
• invalid ip address: %s
• phishlet '%s' can't be deleted - you can only delete child p

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c50c28f09b05a8a3. Report an issue: GitHub.