What causes "script not found" in kgretzky/evilginx2?

Verify the id passed to GetScriptInject matches an existing js_inject entry in the phishlet YAML

script not found

Error message

script not found

What it means

GetScriptInject(id, params) returns this error when no js_inject entry registered on the phishlet matches the given id. The method iterates p.js_inject and falls through to `return "", "", fmt.Errorf("script not found")` if the loop completes without a match. It signals that the caller requested an injection script by an id that was never loaded from the phishlet config.

Source

Thrown at core/phishlet.go:855

						params_matched = true
					}
				} else {
					params_matched = true
				}

				if params_matched {
					script := js.script
					if params != nil {
						for k, v := range *params {
							script = strings.Replace(script, "{"+k+"}", v, -1)
						}
					}
					return js.id, script, nil
				}
			}
		}
	}
	return "", "", fmt.Errorf("script not found")
}

func (p *Phishlet) GetScriptInjectById(id string, params *map[string]string) (string, error) {
	for _, js := range p.js_inject {
		if js.id == id {
			script := js.script
			if params != nil {
				for k, v := range *params {
					script = strings.Replace(script, "{"+k+"}", v, -1)
				}
			}

			return script, nil
		}
	}
	return "", fmt.Errorf("script not found")
}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Verify the id passed to GetScriptInject matches an existing js_inject entry in the phishlet YAML
Reload/re-list phishlet js_inject entries after any phishlet file edit and refresh cached ids
Handle the error at call sites by skipping the injection instead of treating it as fatal

Example fix

// before
script, jsId, err := ph.GetScriptInject(oldId, params)
// after
script, jsId, err := ph.GetScriptInject(currentJsInjectId, params)
if err != nil {
    log.Warning("js_inject %s unavailable: %v", currentJsInjectId, err)
    return
}

Defensive patterns

Strategy: try-catch

Validate before calling

ids := ph.GetScriptInjects() // or re-list js_inject after reload
if !contains(ids, requestedId) {
    log.Warning("script id %q not present in phishlet", requestedId)
    return
}

Type guard

func scriptExists(ph *core.Phishlet, id string) bool {
    for _, js := range ph.GetScriptInjects() {
        if js == id { return true }
    }
    return false
}

Try / catch

script, jsId, err := ph.GetScriptInject(id, params)
if err != nil {
    log.Debug("script not found for id %s: %v", id, err)
    // proceed without injection
    return "", ""
}

Prevention

Re-resolve script ids after every phishlet reload
Never hard-code js_inject ids; look them up dynamically
Treat 'script not found' as a soft, non-fatal condition
Log id mismatches to detect phishlet schema drift

When it happens

Trigger: Calling p.GetScriptInject("some-id", params) with an id that does not correspond to any `js_inject` entry in the phishlet, e.g. after the phishlet was reloaded and js_inject ids changed, or a stale id cached elsewhere.

Common situations: HTTP proxy referencing a script id from an older phishlet version; typo in the id string; phishlet file re-edited so js_inject blocks were renamed or removed while sessions still reference them.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/d1fc37cfe7239d4d. Report an issue: GitHub.