This course equips PHP developers with the essential skills needed to make their applications resilient against modern internet threats. It explores web vulnerabilities through PHP examples that go beyond the OWASP Top Ten, addressing various injection attacks, script injections, session handling issues, insecure direct object references, file upload vulnerabilities, and more. PHP-related vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- or state-related issues. For the latter, we examine attacks like open_basedir circumvention, denial-of-service via magic float, and hash table collision attacks. In each scenario, participants will learn the key techniques and functions required to mitigate these risks.
Particular emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces various PHP extensions for cryptography (such as hash, mcrypt, and OpenSSL) and for input validation (including Ctype, ext/filter, and HTML Purifier). Best practices for hardening PHP configuration (php.ini settings), Apache, and the server environment are also covered. Additionally, participants will gain an overview of security testing tools and techniques available to developers and testers, including security scanners, penetration testing tools, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and configuration practices are reinforced through hands-on exercises. These activities demonstrate the consequences of successful attacks, show how to apply mitigation techniques, and guide participants in using various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilize various PHP security features
- Identify typical coding mistakes and learn how to avoid them
- Stay informed about recent PHP framework vulnerabilities
- Acquire practical experience with security testing tools
- Access resources and further reading on secure coding practices
Audience
Developers
Read more...
