Error handling is a deceptively simple concept that has significant security implications. When applications encounter errors, they must balance providing useful feedback to users while not revealing internal details to attackers. This category tests whether error responses expose stack traces, database queries, file paths, server versions, or other information that helps attackers understand and exploit the application. Proper error handling returns generic user-friendly messages while logging detailed errors server-side. For security testers, triggering errors is a valuable reconnaissance technique that often reveals more about the application than any other single test. This is one of the most beginner-friendly testing categories and an excellent starting point for those new to web security testing.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-ERRH-01 | Improper Error Handling | CWE-209 | Beginner |
| WSTG-ERRH-02 | Stack Trace Testing | CWE-209, CWE-210 | Beginner |
Detailed Test Cases
WSTG-ERRH-01: Improper Error Handling
BeginnerThis test triggers error conditions in the application and examines the error responses for sensitive information leakage. It covers HTTP error codes, application error messages, and edge cases that produce unhandled exceptions revealing internal details.
What to Check
- Trigger 404 errors and check if default server error pages reveal version information
- Submit invalid input to form fields and check for database error messages
- Send malformed requests (wrong Content-Type, missing parameters) and analyze responses
- Test for different error behavior between authenticated and unauthenticated states
- Check if error messages differ in a way that reveals valid versus invalid resources
WSTG-ERRH-02: Stack Trace Testing
BeginnerThis test specifically targets the exposure of stack traces in error responses. Stack traces provide a detailed call chain showing exactly which functions were executed, the file paths, line numbers, and often the parameters that caused the error.
What to Check
- Submit unexpected data types to trigger type conversion errors
- Send oversized input to trigger buffer or memory-related errors
- Request non-existent resources to trigger routing or file system errors
- Test API endpoints with malformed JSON or XML to trigger parsing errors
- Check if stack traces are returned in HTTP response body, headers, or both
Relevant Certifications
The following certifications cover error handling concepts:
Frequently Asked Questions
Why is error handling important for web application security?
Error handling is important because detailed error messages can reveal sensitive internal information to attackers, including database schemas, file paths, technology versions, and internal logic. This information helps attackers craft targeted exploits. Proper error handling shows generic messages to users while logging technical details server-side for debugging.
What kind of information can stack traces expose?
Stack traces can expose programming language and version, framework and library versions, internal file paths and directory structures, database connection strings and query details, internal function and variable names, and sometimes even source code snippets. Each piece of information helps an attacker build a more targeted attack against the application.
How should web applications handle errors securely?
Applications should return generic, user-friendly error pages (like a simple 'Something went wrong') without technical details. All detailed error information should be logged server-side with correlation IDs that support staff can use to look up the details. Applications should never display stack traces, SQL queries, or internal paths to end users, even in development environments exposed to the internet.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →