This course equips PHP developers with the essential skills needed to build applications that are resilient against modern Internet-based threats. It explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to address a wide range of injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard types, such as missing or inadequate input validation, incorrect error and exception handling, misuse of security features, and time- or state-related flaws. Specific attacks discussed include open_basedir circumvention, denial-of-service via magic float, and hash table collision attacks. In each scenario, participants will learn the critical techniques and functions required to mitigate these risks.
A dedicated focus is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces various PHP security extensions, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Comprehensive hardening practices are covered, relating to PHP configuration (php.ini), Apache, and general server settings. Additionally, an overview is provided of various security testing tools and techniques available to developers and testers, such as security scanners, penetration testing, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and the configuration practices are reinforced through hands-on exercises that demonstrate the impact of successful attacks, illustrate how to apply mitigation strategies, and introduce the use of relevant extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and know how to prevent them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilize various security features in PHP
- Identify common coding mistakes and learn how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical experience with security testing tools
- Access resources and further reading on secure coding practices
Audience
Developers
Read more...
