What causes "enabling phishlet '%s' requires its hostname to be set up" in kgretzky/evilginx2?

Set the hostname first: phishlets hostname , then enable it

enabling phishlet '%s' requires its hostname to be set up

Error message

enabling phishlet '%s' requires its hostname to be set up

What it means

SetSiteEnabled refuses to enable a phishlet whose hostname has not been configured. Enabling requires a live hostname so active hostnames and certificate provisioning can be set up; enabling a hostname-less phishlet would create an unusable, unroutable lure. It returns the error to the caller (handlePhishlets in the admin console) after logging.

Source

Thrown at core/config.go:401

func (c *Config) IsLureHostnameValid(hostname string) bool {
	for _, l := range c.lures {
		if l.Hostname == hostname {
			if c.PhishletConfig(l.Phishlet).Enabled {
				return true
			}
		}
	}
	return false
}

func (c *Config) SetSiteEnabled(site string) error {
	pl, err := c.GetPhishlet(site)
	if err != nil {
		log.Error("%v", err)
		return err
	}
	if c.PhishletConfig(site).Hostname == "" {
		return fmt.Errorf("enabling phishlet '%s' requires its hostname to be set up", site)
	}
	if pl.isTemplate {
		return fmt.Errorf("phishlet '%s' is a template - you have to 'create' child phishlet from it, with predefined parameters, before you can enable it.", site)
	}
	c.PhishletConfig(site).Enabled = true
	c.refreshActiveHostnames()
	c.VerifyPhishlets()
	log.Info("enabled phishlet '%s'", site)

	c.SavePhishlets()
	return nil
}

func (c *Config) SetSiteDisabled(site string) error {
	if _, err := c.GetPhishlet(site); err != nil {
		log.Error("%v", err)
		return err
	}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Set the hostname first: phishlets hostname <phishlet> <your-domain>, then enable it
For child phishlets, create them with the hostname custom parameter included
Verify with 'phishlets get-hosts <phishlet>' that hostnames are set before enabling
Fix automation to always set hostname before calling SetSiteEnabled

Example fix

// console
// before
phishlets enable linkedin
// after
phishlets hostname linkedin ln.example.com
phishlets enable linkedin

Defensive patterns

Strategy: validation

Validate before calling

// before SetSiteEnabled
if cfg := c.PhishletConfig(site); cfg == nil || cfg.Hostname == "" {
    return fmt.Errorf("set hostname for %s first: phishlets hostname %s <domain>", site, site)
}
c.SetSiteEnabled(site, true)

Try / catch

if err := c.SetSiteEnabled(site, true); err != nil {
    if strings.Contains(err.Error(), "requires its hostname to be set up") {
        log.Printf("run 'phishlets hostname %s <domain>' first", site)
    }
    return err
}

Prevention

Always run 'phishlets hostname <name> <domain>' immediately after loading a phishlet
In automation, assert hostname is non-empty before enabling
Verify with 'phishlets get-hosts <name>' before enable
Include hostname as a required parameter when creating child phishlets

When it happens

Trigger: Running 'phishlets enable <name>' (handlePhishlets → SetSiteEnabled) on a phishlet where 'phishlets hostname <name> <host>' was never executed, so PhishletConfig(site).Hostname == ""; also applies to child phishlets created without a hostname parameter.

Common situations: Fresh install where users enable a phishlet straight after loading it; automation scripts that enable phishlets but skip the hostname step; creating a child phishlet without passing the hostname custom parameter.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/bcf0cd49e8a0f2f5. Report an issue: GitHub.