This course equips PHP developers with the essential skills needed to build applications that are resilient against modern internet-based threats. We explore web vulnerabilities through PHP examples, extending beyond the OWASP Top Ten to cover a wide range of issues, including various injection attacks, script injections, weaknesses in PHP session handling, insecure direct object references, file upload vulnerabilities, and more. PHP-related vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related issues. For the latter, we examine attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In every scenario, participants will learn the key techniques and functions required to mitigate these risks.
A special emphasis is placed on client-side security, addressing security concerns related to JavaScript, Ajax, and HTML5. We introduce several PHP extensions for security purposes, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache, and general server settings. Finally, we provide an overview of various security testing tools and techniques that developers and testers can utilize, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and the configuration practices are supported by hands-on exercises that demonstrate the consequences of successful attacks, show how to apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
- Gain insight into client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilize various security features within PHP
- Identify typical coding mistakes and learn how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical knowledge in using security testing tools
- Receive sources and further reading on secure coding practices
Audience
Developers
Read more...
