This course equips PHP developers with the essential skills needed to make their applications resilient against modern Internet-based threats. The curriculum explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to address various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related problems. Specific topics include mitigating risks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will master the key techniques and functions required to mitigate these identified risks.
A special emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several PHP extensions relevant to security, such as hash, mcrypt, and OpenSSL for cryptographic operations, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are covered in the context of PHP configuration (php.ini), Apache, and server management. Additionally, the course provides an overview of various security testing tools and techniques available to developers and testers, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and configuration best practices are reinforced through hands-on exercises. These demonstrations illustrate the impact of successful attacks, show how to apply mitigation strategies, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding
- Understand web vulnerabilities beyond the OWASP Top Ten and learn how to avoid them
- Learn about client-side vulnerabilities and secure coding practices
- Gain a practical understanding of cryptography
- Master the use of various PHP security features
- Avoid typical coding mistakes and understand common pitfalls
- Stay informed about recent vulnerabilities affecting the PHP framework
- Acquire practical knowledge on using security testing tools
- Receive resources and further reading materials on secure coding practices
Audience
Developers
Read more...
