This course equips PHP developers with the essential skills needed to build applications that are resilient against modern internet-based threats. Web vulnerabilities are explored through PHP-specific examples that extend beyond the OWASP Top Ten, addressing various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard vulnerability types, including missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related problems. The latter includes attacks such as open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In all scenarios, participants will learn the key techniques and functions required to mitigate these risks.
Special attention is given to client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several security-related PHP extensions, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache, and server administration generally. Finally, an overview of various security testing tools and techniques is offered for developers and testers, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
The introduction of vulnerabilities and configuration practices is reinforced by hands-on exercises. These demonstrate the consequences of successful attacks, show how to apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
- Understand client-side vulnerabilities and secure coding practices
- Gain a practical understanding of cryptography
- Learn to utilize various security features in PHP
- Identify common coding mistakes and learn how to avoid them
- Stay informed about recent vulnerabilities in the PHP framework
- Acquire practical knowledge of using security testing tools
- Receive resources and further readings on secure coding practices
Audience
Developers
Read more...
