Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-errh-01Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | wstg-errh-01 |
| description | Testing for Improper Error Handling |
| category | error-handling |
| owasp_id | WSTG-ERRH-01 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["error-handling","information-leak","stack-trace","wstg","errh"] |
| tech_stack | [] |
| cwe_ids | ["CWE-209"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-ERRH-01
Testing for Improper Error Handling
Improper error handling can reveal sensitive information about the application's internal workings, including technology stack, database structure, file paths, and configuration details. Attackers use this information to craft more targeted attacks. Proper error handling should provide minimal information to users while logging detailed information securely on the server.
| Scenario | Potential Disclosure |
|---|---|
| Invalid input | Framework info |
| Database errors | SQL structure |
| File operations | Path disclosure |
| Authentication failures | User enumeration |
| Authorization errors | Role information |
| Server errors (500) | Stack traces |
#!/bin/bash
TARGET="https://target.com"
# Test 404 errors
curl -s "$TARGET/nonexistent-page-12345"
curl -s "$TARGET/../../../etc/passwd"
curl -s "$TARGET/%00"
# Test 500 errors
curl -s
curl -s
curl -s -X POST -d
curl -s -H
curl -s -H
curl -s
curl -s
curl -s
#!/bin/bash
TARGET="https://target.com"
# Collect errors and analyze
payloads=(
"'"
"\""
";"
"../"
"<script>"
"{{7*7}}"
"%00"
"%0a"
"null"
"-1"
)
for payload in "${payloads[@]}"; do
echo "=== Testing: $payload ==="
response=$(curl -s "$TARGET/api/search?q=$payload")
# Check for sensitive information
echo "$response" | grep -iE "exception|error|stack|trace|warning|sql|mysql|oracle|postgres|path|file|line|debug|internal" | head -5
# Check for technology disclosure
echo "$response" | grep -iE "asp\.net|php|java|python|ruby|django|laravel|spring|express" | head -5
echo ""
done
#!/bin/bash
TARGET="https://target.com"
# SQL injection payloads to trigger errors
sql_payloads=(
"'"
"''"
"1'"
"1' OR '1'='1"
"1' AND '1'='2"
"1; DROP TABLE users--"
"1 UNION SELECT 1,2,3--"
"1' WAITFOR DELAY '0:0:5'--"
)
for payload in "${sql_payloads[@]}"; do
response=$(curl -s "$TARGET/api/user?id=$payload")
# Check for SQL error disclosure
if echo "$response" | grep -qiE "sql|syntax|mysql|oracle|postgres|mssql|sqlite|ORA-|PLS-|SP2-"; then
echo "[VULN] SQL error disclosure with: $payload"
echo "$response" | head -5
fi
done
#!/usr/bin/env python3
import requests
import re
from urllib.parse import urljoin
class ErrorHandlingTester:
def __init__(self, base_url):
self.base_url = base_url
self.session = requests.Session()
self.findings = []
# Sensitive patterns to detect
SENSITIVE_PATTERNS = {
'stack_trace': r'(at\s+\w+\.\w+\(.*:\d+\)|Traceback \(most recent|Exception in thread)',
'file_path': r'(/var/www/|/home/\w+/|C:\\|/app/|/opt/)',
'sql_error': r'(SQL syntax|mysql_|ORA-\d+|PG::|sqlite|ODBC)',
'technology': r'(PHP/|ASP\.NET|X-Powered-By|Server: Apache|nginx)',
'debug_info': r'(DEBUG|NOTICE|WARNING|Error in|Line \d+)',
'internal_ip': r'(192\.168\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+)',
'credentials': r'(password|api_key|secret|token|auth).*[:=]',
}
def test_error_scenarios(self):
"""Test various error scenarios"""
print("[*] Testing error handling scenarios...")
test_cases = [
# Path traversal
("/../../../../etc/passwd", "GET", None),
("/%00", "GET", None),
# SQL injection
("/api/user?id='", "GET", None),
("/api/user?id=1 OR 1=1", "GET", None),
# Invalid JSON
("/api/data", "POST", "invalid-json"),
# Non-existent resources
("/nonexistent-12345", "GET", None),
("/api/nonexistent", "GET", None),
# Type confusion
("/api/user?id[]=1", "GET", None),
("/api/user?id=null", "GET", None),
# Large input
("/search?q=" + "A" * 5000, "GET", None),
# Special characters
("/api/search?q=%00%0a%0d", "GET", None),
]
for path, method, data in test_cases:
self._test_endpoint(path, method, data)
return self.findings
def _test_endpoint(self, path, method="GET", data=None):
"""Test single endpoint for error disclosure"""
url = urljoin(self.base_url, path)
try:
if method == "GET":
response = self.session.get(url, timeout=10)
else:
response = self.session.post(url, data=data, timeout=10)
self._analyze_response(url, response)
except requests.exceptions.RequestException as e:
pass
def _analyze_response(self, url, response):
"""Analyze response for sensitive information"""
content = response.text
for pattern_name, pattern in self.SENSITIVE_PATTERNS.items():
matches = re.findall(pattern, content, re.IGNORECASE)
if matches:
finding = {
"url": url,
"type": pattern_name,
"matches": matches[:3], # First 3 matches
"severity": self._get_severity(pattern_name)
}
self.findings.append(finding)
print(f"[VULN] {pattern_name} at {url}")
print(f" Sample: {matches[0][:100] if matches else ''}")
def _get_severity(self, pattern_type):
"""Get severity based on pattern type"""
high_severity = ['stack_trace', 'sql_error', 'credentials', 'internal_ip']
medium_severity = ['file_path', 'debug_info']
if pattern_type in high_severity:
return "High"
elif pattern_type in medium_severity:
return "Medium"
return "Low"
def test_http_methods(self):
"""Test error handling for different HTTP methods"""
print("\n[*] Testing HTTP method error handling...")
methods = ["OPTIONS", "PUT", "DELETE", "PATCH", "TRACE"]
for method in methods:
try:
response = self.session.request(method, self.base_url, timeout=10)
self._analyze_response(f"{self.base_url} [{method}]", response)
except:
pass
def test_custom_headers(self):
"""Test error handling with malformed headers"""
print("\n[*] Testing header error handling...")
headers_tests = [
{"Content-Length": "-1"},
{"Content-Type": "invalid/type"},
{"Accept": "../../../etc/passwd"},
{"X-Forwarded-For": "' OR '1'='1"},
]
for headers in headers_tests:
try:
response = self.session.get(self.base_url, headers=headers, timeout=10)
self._analyze_response(f"{self.base_url} [headers]", response)
except:
pass
def generate_report(self):
"""Generate error handling report"""
print("\n" + "="*60)
print("ERROR HANDLING TEST REPORT")
print("="*60)
if not self.findings:
print("\nNo sensitive information disclosure found.")
return
print(f"\nTotal findings: {len(self.findings)}")
# Group by severity
by_severity = {}
for f in self.findings:
sev = f['severity']
if sev not in by_severity:
by_severity[sev] = []
by_severity[sev].append(f)
for severity in ['High', 'Medium', 'Low']:
if severity in by_severity:
print(f"\n{severity} ({len(by_severity[severity])}):")
for finding in by_severity[severity]:
print(f" - {finding['type']} at {finding['url'][:50]}")
# Usage
tester = ErrorHandlingTester("https://target.com")
tester.test_error_scenarios()
tester.test_http_methods()
tester.test_custom_headers()
tester.generate_report()
| Tool | Description | Usage |
|---|---|---|
| Burp Suite | Error interception | Analyze responses |
| OWASP ZAP | Automated scanning | Error detection |
| curl | Manual testing | Trigger errors |
from flask import Flask, jsonify
app = Flask(__name__)
@app.errorhandler(Exception)
def handle_exception(e):
# Log detailed error internally
app.logger.error(f"Error: {str(e)}", exc_info=True)
# Return generic message to user
return jsonify({
"error": "An unexpected error occurred",
"message": "Please try again later"
}), 500
@app.errorhandler(404)
def not_found(e):
return jsonify({"error": "Resource not found"}), 404
@app.errorhandler(400)
def bad_request(e):
return jsonify({"error": "Invalid request"}), 400
# Disable debug mode in production
DEBUG = False
TESTING = False
# Configure secure logging
import logging
logging.basicConfig(
filename='/var/log/app/error.log',
level=logging.ERROR,
format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)
# Nginx - disable server version
server_tokens off;
# Custom error pages
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
internal;
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
internal;
}
| Finding | CVSS | Severity |
|---|---|---|
| Full stack trace exposure | 5.3 | Medium |
| SQL error messages | 5.3 | Medium |
| File path disclosure | 4.3 | Medium |
| Technology version disclosure | 3.7 | Low |
| Debug information | 5.3 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-209 | Information Exposure Through Error Message | Sensitive info in errors |
| CWE-211 | Externally-Generated Error Message | External error details |
| CWE-215 | Information Exposure Through Debug | Debug info exposure |
[ ] 404 error pages tested
[ ] 500 error pages tested
[ ] SQL error messages tested
[ ] File operation errors tested
[ ] Invalid input errors tested
[ ] HTTP method errors tested
[ ] Header manipulation tested
[ ] Stack traces checked
[ ] Technology disclosure checked
[ ] Path disclosure checked
[ ] Findings documented
[ ] Remediation recommendations provided