What causes "session not found: %s" in kgretzky/evilginx2?

Confirm the sid exists via sessionsList before operating on it, or generate a fresh session when lookup fails

session not found: %s

Error message

session not found: %s

What it means

Returned by sessionsGetBySid when a buntdb transaction iterates the sessions_sid index with AscendEqual for the given session_id string and finds no matching record. It means no Session carrying that session_id exists in the database. Note the same lookup is used inside sessionsCreate as an existence check, where a nil error means 'exists'.

Source

Thrown at database/db_session.go:217

		return err
	})
	if err != nil {
		return nil, err
	}
	return s, nil
}

func (d *Database) sessionsGetBySid(sid string) (*Session, error) {
	s := &Session{}
	err := d.db.View(func(tx *buntdb.Tx) error {
		found := false
		err := tx.AscendEqual("sessions_sid", d.getPivot(map[string]string{"session_id": sid}), func(key, val string) bool {
			json.Unmarshal([]byte(val), s)
			found = true
			return false
		})
		if !found {
			return fmt.Errorf("session not found: %s", sid)
		}
		return err
	})
	if err != nil {
		return nil, err
	}
	return s, nil
}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Confirm the sid exists via sessionsList before operating on it, or generate a fresh session when lookup fails
Treat the error as an unknown/expired session and issue a new one rather than retrying the same sid
Check the database file actually contains sessions (path/config pointing at the right data dir)
If sessions are being purged too early, adjust session expiry/cleanup settings

Example fix

// before
s, err := db.GetSessionBySid(sid)
if err != nil { return err }
// after
s, err := db.GetSessionBySid(sid)
if err != nil {
    // unknown sid: create a new session for this visitor
    return db.CreateSession(newSid(), phishlet, landingURL, ua, addr)
}

Defensive patterns

Strategy: try-catch

Validate before calling

sessions, err := db.GetSessions()
if err == nil {
    found := false
    for _, s := range sessions {
        if s.SessionId == sid { found = true; break }
    }
    if !found { return nil }
}

Type guard

func sessionExists(db *database.Database, sid string) bool {
    _, err := db.GetSessionBySid(sid)
    return err == nil
}

Try / catch

s, err := db.GetSessionBySid(sid)
if err != nil {
    if strings.HasPrefix(err.Error(), "session not found") {
        return newSessionForVisitor() // issue fresh session
    }
    return err
}

Prevention

Handle unknown sids from client cookies as 'new visitor', not a hard failure
Be aware session expiry/cleanup may delete sessions between calls — always handle not-found
Verify the data directory / database file in use is the one containing your sessions

When it happens

Trigger: Calling GetSessionBySid (or sessionsUpdateUsername/sessionsUpdatePassword/sessionsDeleteBySid paths that resolve by sid) with a session_id that is absent — deleted session, purged expired session, or a sid parsed from a client cookie that was never registered.

Common situations: A victim's browser presents an old session cookie after the server database was wiped/restored; the session expired and was cleaned up but the client still sends the sid; typo'd or attacker-forged sid values in requests; hostname/phishlet config changes invalidating stored sessions.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/adb274f6a928939c. Report an issue: GitHub.