This course equips PHP developers with essential skills to protect their applications against modern Internet-based threats. It explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to address various injection attacks, script injections, session handling flaws, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- or state-related problems. Specific examples include open_basedir circumvention, denial-of-service attacks via magic floats, and hash table collision attacks. In each case, participants will learn key techniques and functions to mitigate these risks.
A significant emphasis is placed on client-side security, addressing vulnerabilities in JavaScript, Ajax, and HTML5. The course introduces several PHP security extensions, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are covered in the context of PHP configuration (php.ini), Apache, and general server settings. Additionally, the course provides an overview of security testing tools and techniques for developers and testers, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and configuration practices are reinforced with hands-on exercises. These demonstrate the impact of successful attacks, show how to implement mitigation strategies, and introduce the use of various extensions and tools.
Participants attending this course will
- Gain a solid understanding of security concepts, IT security, and secure coding principles
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
- Understand client-side vulnerabilities and adopt secure coding practices
- Develop a practical grasp of cryptography
- Learn to utilize various PHP security features effectively
- Identify common coding errors and understand how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical experience with security testing tools
- Access resources and further reading on secure coding practices
Audience
Developers
Read more...
