EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesMedium
A penetration tester is evaluating the security of a client's web application. They notice that when they input invalid data into a form field, the application returns verbose error messages that include internal file paths, database query syntax, and even parts of the source code. What countermeasure should the client prioritize to mitigate this information disclosure vulnerability?
- AConfigure generic error messages and disable detailed debugging output in production.
- BDeploy a Web Application Firewall (WAF).
- CEnforce strong password policies for all user accounts.
- DImplement client-side input validation.
Show answer & explanationAnswer & explanation
Correct answer: A. Configure generic error messages and disable detailed debugging output in production.
Verbose error messages that expose internal file paths, database query syntax, or source code are a critical information disclosure vulnerability. The most direct and effective countermeasure is to configure the application to display only generic error messages to users and to disable detailed debugging output in a production environment.
Why the other options are wrong
- B. A WAF can help filter malicious input, but it might not inherently prevent the application from generating verbose error messages if the underlying code is vulnerable.
- C. Strong password policies are crucial for authentication but do not mitigate information disclosure through verbose error messages.
- D. Client-side input validation improves user experience and client-side security but can be bypassed, and doesn't prevent server-side verbose errors.
Verbose Error Message Countermeasures
Measures taken to prevent web applications from disclosing sensitive internal information (like file paths, database errors, or code snippets) through overly detailed error messages.
- Verbose errors leak internal details
- Implement generic error pages
- Disable debugging in production
- Log detailed errors internally only
Memory trick: Generic errors hide secrets, like a plain wrapper on a gift.