hunt-exceptional-conditions

仓库创建 2026年5月5日最近提交 1 天前SkillHot 收录 1 天前

▸ 精选理由

能发现高价值的堆栈或配置泄露问题

▸ 风险提示

用于渗透测试需授权，可能揭露敏感信息

这个 Skill 做什么

检测异常输入导致的冗长错误页或内部信息泄露问题

对任何接受输入的接口投放畸形或超长数据（坏 JSON、类型错误、超大字段、空字节等），看服务是否崩溃并把内部信息原样返回——比如堆栈跟踪、ORM 细节、服务器文件路径或库版本等。用在检测错误处理不足或开发错误页泄露的场景，能发现把调试信息当成生产输出的严重信息泄露问题。

▸ 展开 SKILL.md 英文原文

Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions, or a language traceback. Use on any input-accepting endpoint (JSON APIs, forms, query params). Medium-High when the leak exposes internal structure that arms a deeper attack.

开发编程错误处理信息泄露异常输入通用

3.2k

Stars

493

Forks

仓库内 Skill

+332

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-exceptional-conditions/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-exceptional-conditions/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# HUNT-EXCEPTIONAL-CONDITIONS — Verbose Errors / Fail-Open (A10:2025)

## What actually pays

Well-built apps catch errors and return a clean, generic message. A broken app,
when handed input it didn't expect, throws an unhandled exception and renders a
**developer error page** straight to the client — leaking the stack trace, the
ORM/query internals, server-side file paths, and framework/library versions.
That disclosure is the finding (and it arms SQLi/RCE/path attacks next).

## Recon

Any endpoint that parses input is a candidate; the richest are:

```
JSON APIs that expect typed fields:  POST /api/* with {numbers, ids, enums}
Endpoints with numeric/id path or query params:  /item/{id},

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有