hunt-exceptional-conditions

Send input the code does not expect, such as a wrong type, truncated JSON, oversized number, or null byte, one change at a time. Then inspect the response body for stack traces, framework error pages, internal file paths, or library versions rather than just the status code.

A finding is confirmed when the response body leaks internals like a SequelizeDatabaseError, PHP warning with a server path, Python traceback, Java stack frames, or a .NET YSOD. A clean JSON error like {"error":"Invalid input"} is correct handling, not a finding.

JSON APIs expecting typed fields, endpoints with numeric or ID path and query parameters, search and filter parameters, and file upload handlers are the richest targets. Any endpoint that parses user input is a candidate.

No, a 500 status alone is not disclosure. You must capture the leaked artifact in the body, such as a stack frame, ORM class, absolute path, or library version, as evidence of the finding.

Document the exact leaked artifact and note what it enables next. A disclosed SQL error points toward SQL injection testing, while a disclosed absolute path supports path traversal or local file inclusion testing.