Post cover image
Figure 1: Sending the valid product request with an integer parameter to Burp Repeater.

August 12, 2026

Lab Write-up: Information Disclosure in Error Messages

Objective

By Ayeshaaghafoor

1 min read

Objective

The goal of this lab is to identify an information disclosure vulnerability within verbose error messages to determine the version number of a third-party framework used by the application, and then submit it to solve the lab.

Step-by-Step Exploitation

Step 1: Intercept and Analyze the Request

  1. Open the lab and navigate to any product page.
  2. Ensure your Burp Suite proxy is running and capturing traffic.
  3. Locate the GET /product?productId=1 request in your HTTP history (the ID value might vary depending on the product you selected).
  4. Right-click on the request and select Send to Repeater.
None

Step 2: Trigger the Error

  1. Go to the Repeater tab.
  2. Modify the value of the productId parameter from an integer (e.g., 1) to a non-integer data type or a custom string, such as wat or "example".
  3. Click Send.

The application fails to handle this unexpected input format properly, causing a runtime exception (java.lang.NumberFormatException) and printing a full, verbose stack trace in the server's response.

None

Step 3: Extract the Version and Submit

  1. Analyze the stack trace provided in the response window. Verbose error logs often leak underlying framework details, including their names and precise versions (such as Apache Struts).
  2. Look through the error message details to extract the specific version identifier (e.g., 2.3.31).
  3. Return to the Web Security Academy page, click Submit solution, paste the extracted version number, and submit it to successfully complete the lab.

Remediation

To prevent information disclosure via error messages, implement the following best practices:

  • Disable Verbose Errors in Production: Configure the web server and application frameworks to suppress stack traces, debugging info, and internal error logs on production environments.
  • Generic Error Handling: Implement a global exception handler that catches all unexpected errors and returns a generic, user-friendly message (e.g., "Something went wrong. Please try again later.").
  • Secure Logging: Log detailed stack traces securely to server-side files accessible only to authorized administrators, rather than sending them back to the client browser.