This course equips PHP developers with the critical skills required to build applications that are resilient against modern Internet-based threats. It explores web vulnerabilities using PHP-specific examples, extending beyond the OWASP Top Ten to address various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. The curriculum categorizes PHP-related vulnerabilities into standard types such as missing or incorrect input validation, flawed error and exception handling, misuse of security features, and time- or state-related problems. Special attention is given to advanced threats like open_basedir circumvention, denial-of-service attacks via magic floats, and hash table collision exploits. Participants will learn the most effective techniques and functions for mitigating these risks.
A significant focus is placed on client-side security, addressing issues within JavaScript, Ajax, and HTML5. The course introduces essential PHP extensions such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Participants will receive guidance on hardening best practices related to PHP configuration (php.ini), Apache settings, and general server security. Finally, an overview of various security testing tools and techniques is provided, including security scanners, penetration testing methodologies, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and the configuration practices are supported by hands-on exercises that demonstrate the consequences of successful attacks, illustrate how to apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding principles.
- Explore web vulnerabilities beyond the OWASP Top Ten and learn how to avoid them.
- Understand client-side vulnerabilities and adopt secure coding practices.
- Develop a practical understanding of cryptography.
- Master the use of various security features available in PHP.
- Identify typical coding mistakes and learn strategies to prevent them.
- Stay informed about recent vulnerabilities affecting the PHP framework.
- Gain hands-on experience using security testing tools.
- Access resources and further reading materials on secure coding practices.
Audience
Developers
Read more...
