The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Server and Database Messages

Informative error messages are often returned not by the application itself but

by some back-end component such as a database, mail server, or SOAP server.

If a completely unhandled error occurs, the application will typically respond

with an HTTP 500 status code, and the response body may contain further

information about the error. In other cases, the application may handle the

error gracefully and return a customized message to the user, sometimes

including error information generated by the back-end component.