This course equips PHP developers with the critical skills needed to protect their applications from modern internet-based threats. Through PHP-based examples that extend beyond the OWASP Top Ten, the program covers various injection attacks, script injections, session handling vulnerabilities, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- or state-related problems. In the latter category, we examine attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will learn the essential techniques and functions required to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces key PHP security extensions, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided regarding PHP configuration (php.ini), Apache, and server settings generally. Additionally, an overview of security testing tools and techniques available to developers and testers is presented, covering security scanners, penetration testing, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and the configuration practices are reinforced with hands-on exercises. These exercises demonstrate the impact of successful attacks, show how to implement mitigation strategies, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to avoid them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilize various PHP security features
- Identify typical coding mistakes and learn how to prevent them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical experience using security testing tools
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...
