This course equips PHP developers with the essential skills needed to protect their applications against contemporary internet-based threats. By utilizing PHP-specific examples that extend beyond the OWASP Top Ten, the curriculum covers a wide array of injection attacks, script injections, session handling vulnerabilities, insecure direct object references, file upload issues, and more. PHP vulnerabilities are categorized into standard types such as missing or inadequate input validation, flawed error and exception handling, misuse of security features, and time- or state-related problems. The latter section explores attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Throughout, participants will become familiar with the key techniques and functions required to mitigate these risks.
A significant focus is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several PHP security extensions, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are discussed in the context of PHP configuration (php.ini), Apache, and general server settings. Additionally, the course provides an overview of various security testing tools and techniques available to developers and testers, such as security scanners, penetration testing kits, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction of vulnerabilities and the configuration practices are reinforced through hands-on exercises. These practical sessions demonstrate the impact of successful attacks, show how to apply mitigation strategies, and introduce the usage of various extensions and tools.
Participants attending this course will
- Understand the fundamental concepts of security, IT security, and secure coding.
- Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them.
- Gain insight into client-side vulnerabilities and secure coding practices.
- Develop a practical understanding of cryptography.
- Learn how to utilize various PHP security features.
- Identify common coding mistakes and understand how to prevent them.
- Stay informed about recent vulnerabilities affecting the PHP framework.
- Acquire practical knowledge in using security testing tools.
- Access sources and further reading materials on secure coding practices.
Audience
Developers
Read more...
