This course equips PHP developers with the essential skills required to harden their applications against contemporary internet-based threats. It explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard types such as missing or incorrect input validation, improper error and exception handling, misuse of security features, and time- and state-related problems. Specific attacks discussed include open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will learn the key techniques and functions needed to mitigate these risks.
A significant emphasis is placed on client-side security, addressing vulnerabilities in JavaScript, Ajax, and HTML5. The course introduces several PHP security extensions, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache, and server-level settings. Additionally, the course offers an overview of various security testing tools and techniques, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerability concepts and configuration practices are reinforced with hands-on exercises. These exercises demonstrate the impact of successful attacks, guide participants on applying mitigation strategies, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
- Gain insight into client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilize various PHP security features
- Identify typical coding errors and learn how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical experience using security testing tools
- Access resources and further reading on secure coding practices
Audience
Developers
Read more...
