# Information disclosure in error messages

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FRSnuIZ2cGo9dhyldiCDk%2F1.png?alt=media&#x26;token=b32446ed-ddcb-4595-9d75-8fd06e93eae4" alt=""><figcaption></figcaption></figure>

Let's click on the first product and view it.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVOK5YStVFWX5FWyyAo2x%2F2.png?alt=media&#x26;token=c6878a29-efd4-42a6-bc3f-4dde2519e0d1" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can view this request in the `Proxy > HTTP History`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FzDubYtMBXMkJkjq6ko07%2F3.png?alt=media&#x26;token=d2ba79fc-e7d4-4021-afe1-0b74679da5d4" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification. Once in the `Repeater`, we have to set the `productId` parameter to a not-integer value as follows and send the request to the server:

```
"string"
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQdmBsTWyOmEGwn0XVZtz%2F4.png?alt=media&#x26;token=1aa35b29-0b30-4300-917b-69b6ea50bcde" alt=""><figcaption></figcaption></figure>

```
2 2.3.31
```

As we can see, the server discloses the Apache version in the response. We can not submit this as the answer.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F451tRZ3jCJiZAouPaAi9%2F6.png?alt=media&#x26;token=2308dca5-420d-4f6f-89dd-0be8aab21eaa" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FWpph2IkoiOTDMsg8YjVF%2F7.png?alt=media&#x26;token=d9100cac-eeb2-468e-909a-13ef1aa2e2f2" alt=""><figcaption></figcaption></figure>
