This course equips PHP developers with the essential skills needed to fortify applications against modern internet-based threats. The curriculum explores web vulnerabilities through practical PHP examples that extend beyond the OWASP Top Ten, addressing various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard types such as missing or flawed input validation, improper error and exception handling, misuse of security features, and time- or state-related defects. Specific attack vectors discussed include open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will gain familiarity with key techniques and functions designed to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several PHP extensions for cryptography (such as hash, mcrypt, and OpenSSL) and input validation (including Ctype, ext/filter, and HTML Purifier). Best practices for hardening the environment are covered in conjunction with PHP configuration (php.ini), Apache settings, and general server security. Additionally, the course provides an overview of various security testing tools and techniques available to developers and testers, including vulnerability scanners, penetration testing methods, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and the application of configuration practices are reinforced through hands-on exercises. These sessions demonstrate the impact of successful attacks, guide participants in applying mitigation strategies, and introduce the usage of various extensions and tools.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding.
- Explore web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them.
- Understand client-side vulnerabilities and adopt secure coding practices.
- Develop a practical understanding of cryptography.
- Learn to utilize PHP's built-in security features effectively.
- Identify common coding mistakes and acquire strategies to avoid them.
- Stay informed about recent vulnerabilities within the PHP framework.
- Gain practical experience with security testing tools.
- Access resources and further reading materials on secure coding practices.
Audience
Developers
Read more...
