Secure › Module 5 › Lesson 1
Safe Errors
Fail without leaking stack traces, paths, or SQL — on YOUR $TOY_APP error handlers.
Visual · safe_errors
Safe error handling literacy. $MY_REPO only. Original Cyberlium.
Opening
Users need a generic sorry; logs need detail — both on systems you develop, not stranger stack traces you scrape.
Safe error handling shows generic messages to users while logging detailed diagnostics server-side with correlation IDs. Never return database errors, file paths, or framework versions to clients in production — including your lab deploy of $TOY_APP. Cyberlium teaches try/catch and error middleware patterns in $MY_REPO — not harvesting verbose errors from live shops or classmate APIs. You will NOT publish stranger stack traces in Discord as 'research.' Next: Password Hashing.
1. User-facing vs operator-facing
User sees: 'Something went wrong. Reference ID abc123.' Operator log sees: exception type, stack, request ID — restricted access, chmod 600 notes, no public paste.
On $MY_REPO, wrap one route handler with safe catch that logs internally and returns generic JSON or HTML.
Command guide
Try these commands — User-facing vs operator-facing
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: python3, grep. Reference sites: Error handling (https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html); OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Information disclosure is a vulnerability
Verbose SQL errors aid attackers mapping schema. Path leaks reveal deployment layout. Defenders monitor error rates; developers sanitize responses in code you ship.
Probing stranger sites for verbose errors is recon on others — out of scope.
3. Lab fix on owned app
Replace one leaky error response in $TOY_APP with generic message + structured log line.
Ship: before/after error response note. Next: Password Hashing.
4. What you ship: safe error handler for $TOY_APP
Generic user message + server log with correlation ID. $MY_REPO only. chmod 600.
5. What you record before the next lesson
Date. Error handler change. File t17-m05-l01-safe-errors.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Return full SQL exception to browser in $TOY_APP. Scrape live shop errors for 'intel.'
Right
Implement safe errors on $TOY_APP. Next: Password Hashing.
Mission: safe error handler
1) Find one verbose error path in $TOY_APP. 2) Return generic client message. 3) Log details server-side with ID. Never harvest stranger error pages.
Stuck? Ask Cyberlium AI Mentor
Correlation ID links user report to log line without exposing internals.
Knowledge Check
APPLY: Safe errors on Cyberlium mean:
Multiple choice
Knowledge Check
APPLY: True or False: Database error text in HTTP responses helps attackers.
True or False
Knowledge Check
APPLY: Operator logs should:
Multiple choice