This course equips PHP developers with the vital skills needed to shield their applications from modern Internet-based threats. It explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover a wide array of risks including various injection attacks, script injections, weaknesses in PHP session handling, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard vulnerability types such as inadequate or incorrect input validation, flawed error and exception handling, misuse of security features, and time- or state-related problems. Specific attack vectors discussed include open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In each scenario, participants will learn the key techniques and functions required to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces essential PHP security extensions, such as hash, mcrypt, and OpenSSL for cryptographic purposes, as well as Ctype, ext/filter, and HTML Purifier for robust input validation. Best practices for hardening are provided with respect to PHP configuration (php.ini settings), Apache, and general server administration. Additionally, the course offers an overview of various security testing tools and methodologies available to developers and testers, including security scanners, penetration testing frameworks, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and the discussion of configuration practices are reinforced by hands-on exercises. These activities demonstrate the impact of successful attacks, illustrate how to implement mitigation strategies, and guide participants through the use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding
- Identify web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
- Understand client-side vulnerabilities and adhere to secure coding practices
- Develop a practical understanding of cryptography
- Master the use of various PHP security features
- Recognize common coding errors and learn how to avoid them
- Stay informed about recent vulnerabilities within the PHP framework
- Gain practical experience using security testing tools
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...