This course equips PHP developers with the essential skills needed to build applications that are resilient against modern internet-based threats. The curriculum explores web vulnerabilities through PHP-centric examples, extending beyond the OWASP Top Ten to cover a wide range of injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. These PHP-specific vulnerabilities are categorized into standard vulnerability types, such as missing or flawed input validation, incorrect error and exception handling, misuse of security features, and time- and state-related issues. For the latter category, the course examines attacks like open_basedir circumvention, denial-of-service via magic float, and hash table collision attacks. In each scenario, participants learn the critical techniques and functions required to mitigate these risks.
A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces several PHP extensions, including hash, mcrypt, and OpenSSL for cryptographic purposes, as well as Ctype, ext/filter, and HTML Purifier for robust input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache settings, and general server security. Additionally, the course offers a comprehensive overview of security testing tools and techniques available to developers and testers, such as security scanners, penetration testing methodologies, exploit packs, packet sniffers, proxy servers, fuzzing tools, and static source code analyzers.
The introduction of vulnerabilities and configuration practices is reinforced by numerous hands-on exercises. These exercises demonstrate the impact of successful attacks, illustrate how to implement mitigation strategies, and guide participants in utilizing various extensions and tools effectively.
By the end of this course, participants will
- Grasp the fundamental concepts of security, IT security, and secure coding
- Identify web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
- Comprehend client-side vulnerabilities and secure coding methodologies
- Develop a practical understanding of cryptography
- Master the use of various PHP security features
- Recognize common coding errors and learn how to avoid them
- Stay informed about recent vulnerabilities within the PHP framework
- Gain practical experience with security testing tools
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...
