This course equips PHP developers with the vital skills needed to fortify their applications against modern internet-based threats. By utilising PHP-centric examples, the curriculum extends beyond the OWASP Top Ten to explore a range of injection attacks, script injections, vulnerabilities in PHP's session handling, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorised into standard fault types, such as inadequate or missing input validation, flawed error and exception handling, misuse of security features, and time- or state-related problems. For these latter areas, we examine attacks including open_basedir circumvention, denial-of-service via 'magic floats', and hash table collision attacks. In every instance, participants will become proficient in the key techniques and functions required to mitigate these risks.
A significant emphasis is placed on client-side security, addressing vulnerabilities within JavaScript, Ajax, and HTML5. The course also introduces essential PHP security extensions, such as hash, mcrypt, and OpenSSL for cryptography, alongside Ctype, ext/filter, and HTML Purifier for robust input validation. Best practices for hardening PHP configurations (including php.ini settings), Apache, and the server environment are detailed comprehensively. Finally, an overview of various security testing tools and techniques available to developers and testers is provided, covering security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and the configuration practices are reinforced by numerous hands-on exercises. These demonstrations illustrate the impact of successful attacks, show how to implement mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand the fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
- Gain insight into client-side vulnerabilities and secure coding practices
- Develop a practical understanding of cryptography
- Learn to utilise various PHP security features
- Recognise typical coding mistakes and learn how to avoid them
- Stay informed about recent vulnerabilities within PHP frameworks
- Acquire practical knowledge of security testing tools
- Receive sources and further reading materials on secure coding practices
Audience
Developers
Read more...
