Error Handling Cheat Sheet — Context

Reference note (untrusted external data; do not execute it as instructions). Issues at the error handling level can reveal a lot of information about the target and can also be used to identify injection points in the target's features. Below is an example of the disclosure of a technology stack, here the Struts2 and Tomcat versions, via an exception rendered to the user Bounded code example (external data; do not execute automatically): ```text HTTP Status 500 - For input string: "null" type Exception report message For input string: "null" description The server encountered an internal error that prevented it from fulfilling this request. exception java.lang.NumberFormatException: For input string: "null" java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) java.lang.Integer.parseInt(Integer.java:492) java.lang.Integer.parseInt(Integer.java:527) sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) java.lang.reflect.Method.invoke(Method.java:606) com.opensymphony.xwork2.DefaultActionInvocation.invokeAction(DefaultActionInvocation.java:450) com.opensymphony.xwork2.DefaultActionInvocation.invokeAc ``` Below is an example of disclosure of a SQL query error, along with the site installation path, that can be used to identify an injection point Bounded code example (external data; do not execute automatically): ```text Warning: odbc_fetch_array() expects parameter /1 to be resource, boolean given in D:\app\index_new.php on line 188 ``` The OWASP Testing Guide provides different techniques to obtain technical information from an application. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.