kgretzky/evilginx2 · error

intercept: `path` invalid regular expression: %v

Error message

intercept: `path` invalid regular expression: %v

What it means

This error is thrown when the `path` field of an `intercept` block in a phishlet fails to compile as a Go regular expression (regexp.Compile returns an error). The `%v` is appended with the underlying regexp parse error, e.g. unclosed group or invalid escape. The phishlet is rejected at load time.

Source

Thrown at core/phishlet.go:504

			}
		}
	}
	if fp.Intercept != nil {
		for _, ic := range *fp.Intercept {
			var err error
			var body, mime string
			if ic.Domain == nil {
				return fmt.Errorf("intercept: missing `domain` field")
			}
			if *ic.Domain == "" {
				return fmt.Errorf("intercept: `domain` field cannot be empty")
			}
			if ic.Path == nil {
				return fmt.Errorf("intercept: missing `path` field")
			}
			path_re, err := regexp.Compile(*ic.Path)
			if err != nil {
				return fmt.Errorf("intercept: `path` invalid regular expression: %v", err)
			}
			if ic.HttpStatus == nil {
				return fmt.Errorf("intercept: missing `http_status` field")
			}
			if ic.Body != nil {
				body = *ic.Body
			}
			if ic.Mime != nil {
				mime = *ic.Mime
			}
			err = p.addIntercept(*ic.Domain, path_re, *ic.HttpStatus, body, mime)
			if err != nil {
				return err
			}
		}
	}
	for _, at := range *fp.AuthTokens {
		ttype := "cookie"

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Fix the regular expression in the `path` field, using the exact error text appended to the message to locate the syntax problem.
2. Test the regex against Go's RE2 syntax (no lookaheads/lookbehinds); rewrite patterns that use them (e.g. use `[^/]*` instead of `(?!...)`).
3. Quote the YAML value (single quotes) so special regex characters are not consumed by the YAML parser.

Example fix

// before (phishlet.yml)
intercept:
  - domain: accounts
    path: ^/login(?=\?next)
// after (RE2 has no lookahead)
intercept:
  - domain: accounts
    path: '^/login\?.*next.*'

import "regexp"

for i, ic := range cfg.Intercept {
    if ic.Path == nil {
        continue
    }
    if _, err := regexp.Compile(*ic.Path); err != nil {
        return fmt.Errorf("intercept[%d]: `path` invalid regex: %v", i, err)
    }
}

func isValidRE2Pattern(p string) bool {
    _, err := regexp.Compile(p)
    return err == nil
}

When it happens

Trigger: An intercept block's `path` value contains an invalid regex, such as `path: ^/login(` (unclosed group), a trailing backslash, or Go-RE2-unsupported syntax like lookahead `(?=...)`.

Common situations: Hand-written regexes with unbalanced parentheses/brackets; copying regexes from PCRE/JS sources using lookaheads; unquoted YAML strings whose special characters are truncated by the parser.

Related errors

• intercept: `domain` field cannot be empty
• intercept: missing `path` field
• intercept: missing `http_status` field
• auth_tokens: invalid token type: %s
• auth_tokens: 'domain' not found for cookie auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/5e27f2d58ac2ad27. Report an issue: GitHub.