This course equips PHP developers with the essential skills required to protect their applications against modern Internet-based attacks. The curriculum explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. Vulnerabilities specific to PHP are categorised into standard types such as missing or incorrect input validation, flawed error and exception handling, misuse of security features, and time- and state-related problems. For the latter category, we examine attacks including open_basedir circumvention, denial-of-service via magic floats, and hash table collision exploits. In every instance, participants will learn the key techniques and functions necessary to mitigate these risks.
Special attention is given to client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several PHP extensions for security purposes, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache, and general server settings. Finally, an overview of various security testing tools and techniques available to developers and testers is presented, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and the configuration practices are reinforced by a series of hands-on exercises. These demonstrate the impact of successful attacks, show how to apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding
- Gain knowledge of web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
- Understand client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilise various PHP security features
- Identify typical coding mistakes and understand how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical experience with security testing tools
- Access resources and further reading on secure coding practices
Audience
Developers
Read more...
