hunt-exceptional-conditions

Send input the code does not expect: wrong types like arrays where numbers belong, truncated JSON, oversized or negative values, and null bytes. Then inspect the response body for stack traces, file paths, or framework error pages rather than just the status code.

A finding is confirmed when the response body leaks internals such as a SequelizeDatabaseError, a PHP warning with a server path, a Python traceback, Java stack frames, or a .NET YSOD. A clean JSON error like {"error":"Invalid input"} is correct handling, not a finding.

JSON APIs with typed fields, endpoints with numeric IDs in paths or query strings, search and filter parameters, and file upload handlers are the richest targets. Any endpoint that parses user input is a candidate.

No, a 500 status by itself is not disclosure. You must capture the leaked artifact in the response body, such as an absolute file path, ORM class name, library version, or stack frame, and note what deeper attack it enables.

A disclosed SQL error can lead directly into SQL injection testing, and a disclosed absolute server path can arm local file inclusion attacks. The error leak is both a finding itself and reconnaissance for chained exploits.