hunt-exceptional-conditions

Send input that breaks one assumption at a time: wrong types like arrays where numbers are expected, truncated JSON, oversized values, or null bytes. Then inspect the response body for stack traces, file paths, or framework error pages rather than just the status code.

A response body containing internal details such as a SequelizeDatabaseError, PHP warning with /var/www paths, a Python traceback, Java stack frames, or a .NET YSOD page. A clean JSON error like {"error":"Invalid input"} is correct handling, not a finding.

JSON APIs with typed fields, endpoints with numeric IDs in paths or query strings, search and filter parameters, and file upload handlers are the richest targets. Any endpoint that parses user input is a candidate.

A 500 status only indicates a server error, not disclosure. The finding requires the response body to leak internals like stack frames, ORM classes, absolute paths, or library versions that an attacker can use to plan deeper attacks.

Capture the exact leaked artifact as evidence, such as the path, ORM class, version, or stack frame. Then note what it enables next, for example a disclosed SQL error points toward SQL injection testing and an absolute path points toward file inclusion testing.