This course equips PHP developers with the essential skills needed to fortify their applications against modern internet-based threats. The curriculum explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover a wide range of injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorised into standard vulnerability types, such as missing or flawed input validation, incorrect error and exception handling, misuse of security features, and time- and state-related problems. For the latter, the course examines attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In every instance, participants will learn the critical techniques and functions required to mitigate these risks.
A significant focus is placed on client-side security, addressing vulnerabilities in JavaScript, Ajax, and HTML5. The course introduces key PHP security extensions, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are discussed in the context of PHP configuration (php.ini), Apache, and general server management. Finally, an overview of various security testing tools and techniques is provided, enabling developers and testers to utilise security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction to vulnerabilities and the configuration practices are reinforced by a series of hands-on exercises. These demonstrations illustrate the impact of successful attacks, show how to apply mitigation techniques, and guide participants through the use of various extensions and tools.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to avoid them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilise various PHP security features
- Identify common coding mistakes and learn how to prevent them
- Stay informed about recent vulnerabilities affecting the PHP framework
- Acquire practical experience in using security testing tools
- Access sources and further reading on secure coding practices
Audience
Developers
Read more...
