This course equips PHP developers with the essential skills required to harden applications against modern internet-based threats. It explores web vulnerabilities through practical PHP examples that extend beyond the OWASP Top Ten, addressing issues such as injection attacks, script injection, session handling weaknesses, insecure direct object references, file upload flaws, and more. The curriculum categorizes PHP-related vulnerabilities into standard types, including inadequate or missing input validation, improper error and exception handling, misused security features, and time- or state-related defects. Specific attack vectors discussed include open_basedir circumvention, denial-of-service attacks via magic floats, and hash table collision exploits. Participants will master the critical techniques and functions needed to mitigate these risks.
A significant emphasis is placed on client-side security, covering vulnerabilities in JavaScript, Ajax, and HTML5. The course introduces key PHP extensions for cryptography, such as hash, mcrypt, and OpenSSL, as well as those for input validation, including Ctype, ext/filter, and HTML Purifier. Best practices for hardening are provided regarding PHP configuration (php.ini), Apache server settings, and general server administration. Additionally, the course offers an overview of various security testing tools and techniques available to developers and testers, including security scanners, penetration testing utilities, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the vulnerability concepts and configuration guidelines are reinforced through hands-on exercises. These practical sessions demonstrate the impact of successful attacks, illustrate how to implement mitigation strategies, and guide the use of various extensions and tools.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding
- Understand web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
- Gain insight into client-side vulnerabilities and secure coding methodologies
- Develop a practical understanding of cryptography
- Learn to effectively utilise various PHP security features
- Identify common coding mistakes and discover how to avoid them
- Stay informed about recent vulnerabilities within the PHP framework
- Acquire hands-on experience with security testing tools
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...
