Implementation analysis
Finally, we will conclude this chapter with some tips on how to glean additional information about the implementation of the API’s server, including the host OS and the libraries and frameworks used, including version numbers. Such information can be immensely useful when attempting to reverse-engineer an API.
Verbose error and debug messages
The first category is the now infamous (due to the high instances of information leakage via this method) error category of excessively verbose error and debug messages. Application developers include various levels of diagnostic information to aid in the debugging of applications in the field. Users can capture the log and send it to the support team for analysis. Unfortunately, such logging can be overly verbose and, along with useful debug information, can also divulge the specifics of the inner workings of the application and details of the implementation.
As an example, consider the commonly encountered...
