This course equips PHP developers with the essential skills required to fortify applications against contemporary internet-based attacks. It examines web vulnerabilities through PHP-centric examples, extending beyond the OWASP Top Ten to address various injection attacks, script injections, session handling flaws, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorised into standard types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related problems. For the latter category, we explore attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In each case, participants will master the key techniques and functions needed to mitigate these risks.
Special emphasis is placed on client-side security, addressing issues with JavaScript, Ajax, and HTML5. The course introduces several PHP extensions for security purposes, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. We also provide guidance on hardening practices related to PHP configuration (php.ini), Apache, and the server environment at large. Finally, an overview of various security testing tools and techniques is provided for developers and testers, covering security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the introduction to vulnerabilities and configuration practices are reinforced by numerous hands-on exercises that demonstrate the consequences of successful attacks, show how to apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding
- Gain knowledge of web vulnerabilities beyond the OWASP Top Ten and learn how to avoid them
- Understand client-side vulnerabilities and secure coding practices
- Acquire a practical understanding of cryptography
- Learn to utilise various PHP security features
- Identify typical coding mistakes and learn how to prevent them
- Stay informed about recent PHP framework vulnerabilities
- Gain practical experience with security testing tools
- Access sources and further reading materials on secure coding practices
Audience
Developers
Read more...
