The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 2 

■

Core Defense Mechanisms

27

70779c02.qxd:WileyRed  9/14/07  3:12 PM  Page 27

---

A key defense mechanism is for the application to handle unexpected

errors in a graceful manner, and either recover from them or present a suit-

able error message to the user. In a production context, the application

should never return any system-generated messages or other debug infor-

mation in its responses. As you will see throughout this book, overly verbose

error messages can greatly assist malicious users in furthering their attacks

against the application. In some situations, an attacker can leverage defective

error handling to retrieve sensitive information within the error messages

themselves, providing a valuable channel for stealing data from the applica-

tion. Figure 2-6 shows an example of an unhandled error resulting in a ver-

bose error message.

Figure 2-6: An unhandled error

Most web development languages provide good error-handling support

through try-catch blocks and checked exceptions. Application code should

make extensive use of these constructs to catch specific and general errors and

handle them appropriately. Further, most application servers can be configured

to deal with unhandled application errors in customized ways, for example by