What problem does it solve? Web applications frequently leak internal implementation details through verbose error messages, stack traces, and debug pages, giving attackers a map of the technology stack, file paths, and backend services. This Skill provides a structured methodology, based on OWASP WSTG v4.2 Section 4.8, to systematically identify and analyze these information disclosure weaknesses during penetration tests. ## Core Features & Use Cases - Improper Error Handling Testing (WSTG-ERRH-01): Trigger and analyze errors at the web server and application layers using malformed HTTP requests, type violations, parser-breaking payloads, and boundary values. - Stack Trace Detection (WSTG-ERRH-02): Force unhandled exceptions through type confusion, null references, deserialization failures, and content-type mismatches to expose debug output. - Vulnerability Pattern Catalog: Identify seven common misconfigurations including production debug mode, default server error pages, database error passthrough, and inconsistent microservice error formats. - Use Case: During a web application penetration test, fuzz every input point with targeted payloads, fingerprint distinct error formats to map backend microservices, and document stack trace leakage with remediation guidance for the client report. ## Quick Start Use the wstg-error-handling skill to test this web application for improper error handling and stack trace leakage.
