This course equips PHP developers with the critical skills needed to harden applications against modern internet-based threats. The curriculum explores web vulnerabilities through practical PHP examples that extend beyond the OWASP Top Ten, addressing various injection attacks, script injections, weaknesses in session handling, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard risk types, including inadequate or absent input validation, flawed error and exception handling, misuse of security features, and timing/state-related flaws. Specific attacks covered include open_basedir bypass, denial-of-service via magic floats, and hash table collision attacks. Participants will learn the essential techniques and functions required to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces key PHP extensions such as Hash, MCrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for robust input validation. Best practices for hardening are provided, covering PHP configuration (php.ini), Apache, and general server settings. Additionally, the course offers an overview of security testing tools and methodologies available to developers and testers, including security scanners, penetration testing tools, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both vulnerability concepts and configuration practices are reinforced with hands-on exercises. These exercises demonstrate the impact of successful attacks, guide participants in applying mitigation strategies, and introduce the practical use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding
- Identify web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
- Understand client-side vulnerabilities and secure coding practices
- Gain a practical understanding of cryptography
- Learn to leverage various PHP security features
- Recognize common coding mistakes and know how to avoid them
- Stay informed about recent vulnerabilities within the PHP framework
- Acquire practical experience using security testing tools
- Receive resources and further reading materials on secure coding practices
Audience
Developers
Read more...
