This course equips PHP developers with the essential skills needed to make applications resilient against modern Internet-based attacks. Web vulnerabilities are explored through practical PHP examples that extend beyond the OWASP Top Ten, covering various injection attacks, script injections, weaknesses in session handling, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard vulnerability types, such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related problems. For the latter category, we examine attacks including open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In each scenario, participants will learn key techniques and functions to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces various PHP extensions relevant to security, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening the environment are discussed in the context of PHP configuration (php.ini), Apache server settings, and general server management. Additionally, participants will receive an overview of various security testing tools and techniques available to developers and testers, including security scanners, penetration testing methodologies, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
The introduction of vulnerability concepts and configuration best practices is reinforced through hands-on exercises. These activities demonstrate the impact of successful attacks, illustrate how to implement mitigation strategies, and guide the use of various extensions and tools.
Participants completing this course will:
- Understand fundamental concepts of security, IT security, and secure coding.
- Gain insight into web vulnerabilities beyond the OWASP Top Ten and learn how to avoid them.
- Learn about client-side vulnerabilities and adopt secure coding practices.
- Develop a practical understanding of cryptography.
- Master the use of various PHP security features.
- Identify common coding mistakes and learn how to prevent them.
- Stay informed about recent vulnerabilities affecting PHP frameworks.
- Acquire practical experience using security testing tools.
- Access resources and further reading on secure coding practices.
Audience
Developers
Read more...
