Leveraging error responses for information disclosure

Cool! So, you’ve learned how to identify error codes and messages and you’ve practiced this with a generic API endpoint. It’s now time for you to learn what you can do with the answers you will receive from the requests you are making toward such endpoints. They can be quite revealing. And sometimes, we don’t even need to send pernicious payloads to cause them to fail. Sysadmins and developers may change configurations or parameters based on changes or new application releases, and the new scenarios can cause the API to stop working.

You will see a couple of generic figures in the following sections that show real web applications’ error messages. Observe that in at least one of them, the application simply discloses the versions of both .NET Framework and ASP.NET. This is embarrassing. In this specific case, some changes to a web.config file could suppress that specific line. Likewise, lacking...