{"id":"hunt-exceptional-conditions","name":"hunt-exceptional-conditions","summary":"例外的な条件の誤処理を探す — エンドポイントに誤った形や予期しない入力(誤った型、壊れたJSON、過大なフィールド、ヌルバイト)を与え、OPEN失敗やリーク内部を発生させる:ORM内部、サーバーファイルパス、ライブラリのバージョンなどを開示する冗長なスタックトレース/フレームワークエラーページなどを作ったらしいです。","body":"# HUNT-EXCEPTIONAL-CONDITIONS — Verbose Errors / Fail-Open (A10:2025)\n\n## What actually pays\n\nWell-built apps catch errors and return a clean, generic message. A broken app,\nwhen handed input it didn't expect, throws an unhandled exception and renders a\n**developer error page** straight to the client — leaking the stack trace, the\nORM/query internals, server-side file paths, and framework/library versions.\nThat disclosure is the finding (and it arms SQLi/RCE/path attacks next).\n\n## Recon\n\nAny endpoint that parses input is a candidate; the richest are:\n\n```\nJSON APIs that expect typed fields:  POST /api/* with {numbers, ids, enums}\nEndpoints with numeric/id path or query params:  /item/{id}, ?page=, ?quantity=\nSearch / filter / sort params\nFile or content-type sensitive uploads\n```\n\n## Attack — send what the code didn't anticipate\n\nTake a known-good request and break ONE assumption at a time:\n\n- **Wrong type:** a field the app expects to be a number/string is sent as an\n  array or object — `{\"rating\":\"x\",\"comment\":[1,2,3]}`, `{\"quantity\":{}}`.\n- **Malformed body:** truncated/!invalid JSON, an unterminated string, a stray\n  brace, a wrong/missing Content-Type.\n- **Boundary/oversized:** a very long string, a huge/negative/overflow number.\n- **Null byte / control chars** embedded in a value.\n\n```\nPOST /api/Feedbacks   {\"rating\":\"notanumber\",\"comment\":[1,2,3]}\nGET  /item/' OR /item/%00   (also exercises the error path)\n```\n\nWatch the RESPONSE BODY, not just the status: a 500 (or even a 200/400) whose\nbody contains a stack trace or framework error page is the signal.\n\n## What counts as a leak (the success signal)\n\nA finding is confirmed when the response body contains a cross-framework error-disclosure signature:\n\n- **Node/Express + Sequelize:** `SequelizeDatabaseError`, `node_modules/sequelize`,\n  a JS stack with internal paths.\n- **PHP:** `<b>Warning</b> ... /var/www/.../file.php on line N`.\n- **Python:** `Traceback (most recent call last)`, `werkzeug.exceptions`.\n- **Java:** `at com.app.Foo(Foo.java:42)` stack frames.\n- **.NET:** `Server Error in '/' Application`, a `[System.XxxException: ...]` YSOD.\n\nA clean JSON error (`{\"error\":\"Invalid input\"}`) with no internals is NOT a\nfinding — that's correct handling. Disclosure of internal structure is.\n\n## Validation discipline\n\n- Capture the exact leaked artifact (path, ORM class, version, stack frame) —\n  that's the evidence. \"It returned 500\" alone is not disclosure.\n- Note what the leak enables next (e.g. a disclosed SQL error → hunt-sqli; a\n  disclosed absolute path → hunt-lfi).","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-exceptional-conditions","license":"MIT","category":null,"lang":"en","tokens":651,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}