This course equips PHP developers with essential skills to make their applications resilient against modern internet-based attacks. Web vulnerabilities are explored through PHP-specific examples, extending beyond the OWASP Top Ten list. Topics include various injection attacks, script injections, session handling weaknesses in PHP, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- or state-related problems. These latter issues are addressed through specific attack scenarios like open_basedir circumvention, denial-of-service via magic float, and hash table collision attacks. In every case, participants will master the key techniques and functions required to mitigate these risks.
Special attention is devoted to client-side security, addressing JavaScript, Ajax, and HTML5 vulnerabilities. The course introduces PHP security extensions such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening PHP configurations (php.ini settings), Apache, and the server environment are provided. Additionally, an overview of various security testing tools and techniques is given, enabling developers and testers to utilize security scanners, penetration testing frameworks, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both vulnerability concepts and configuration practices are reinforced with hands-on exercises. These demonstrate the impact of successful attacks, show how to apply mitigation strategies, and guide participants in using various extensions and tools effectively.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding.
- Explore web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them.
- Understand client-side vulnerabilities and adopt secure coding practices.
- Develop a practical understanding of cryptography.
- Learn to leverage PHP's various security features.
- Identify typical coding mistakes and understand how to avoid them.
- Stay informed about recent vulnerabilities affecting the PHP framework.
- Gain hands-on experience with security testing tools.
- Access resources and further reading on secure coding practices.
Audience
Developers
Read more...
