What causes "lure for path '%s' not found" in kgretzky/evilginx2?

List lures and verify the exact path/host/phishlet combination exists before lookup

lure for path '%s' not found

Error message

lure for path '%s' not found

What it means

GetLureByPath exhaustively scanned all lures and found none matching the given site whose hostname (or the phishlet's landing phish host) and path both match. It fires when no lure is registered for that exact site/host/path combination, which can also happen indirectly when the lure references a phishlet that no longer resolves (GetPhishlet error is silently skipped).

Source

Thrown at core/config.go:754

	} else {
		return nil, fmt.Errorf("index out of bounds: %d", index)
	}
}

func (c *Config) GetLureByPath(site string, host string, path string) (*Lure, error) {
	for _, l := range c.lures {
		if l.Phishlet == site {
			pl, err := c.GetPhishlet(site)
			if err == nil {
				if host == l.Hostname || host == pl.GetLandingPhishHost() {
					if l.Path == path {
						return l, nil
					}
				}
			}
		}
	}
	return nil, fmt.Errorf("lure for path '%s' not found", path)
}

func (c *Config) GetPhishlet(site string) (*Phishlet, error) {
	pl, ok := c.phishlets[site]
	if !ok {
		return nil, fmt.Errorf("phishlet '%s' not found", site)
	}
	return pl, nil
}

func (c *Config) GetPhishletNames() []string {
	return c.phishletNames
}

func (c *Config) GetSiteDomain(site string) (string, bool) {
	if o, ok := c.phishletConfig[site]; ok {
		return o.Hostname, ok
	}

View on GitHub (pinned to 4c0988a1d9)

Solutions

List lures and verify the exact path/host/phishlet combination exists before lookup
Normalize the path (trailing slash, URL-decoding, case) before calling
Create the lure with CreateLure if it should exist

Example fix

// before
lure, err := cfg.GetLureByPath(site, host, req.URL.Path)
// after
path := strings.TrimSuffix(req.URL.Path, "/")
lure, err := cfg.GetLureByPath(site, host, path)
if err != nil { /* not a lure URL, handle as normal request */ }

Defensive patterns

Strategy: fallback

Validate before calling

// normalize path before lookup
p := strings.TrimSuffix(req.URL.Path, "/")

Try / catch

lure, err := cfg.GetLureByPath(site, host, path)
if err != nil {
    // treat as non-lure traffic; continue normal proxy handling
}

Prevention

Normalize trailing slashes and case before lookup
Verify phishlet and host match the lure's settings
Handle not-found as normal traffic, not a fatal error

When it happens

Trigger: Calling cfg.GetLureByPath(site, host, path) where no lure exists with that exact Phishlet/Host/Path combination.

Common situations: Path trailing-slash or case mismatches; lure belongs to a different phishlet or host than requested; the lure was deleted or never created; resolving the lure for an incoming request URL that isn't a lure URL.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/78dcf94b96346bd9. Report an issue: GitHub.