This course equips PHP developers with essential skills to fortify applications against modern internet-based threats. It explores web vulnerabilities through practical PHP examples that extend beyond the OWASP Top Ten, addressing injection attacks, script injections, flaws in PHP session handling, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into common patterns such as inadequate or incorrect input validation, poor error and exception handling, misuse of security features, and time- or state-related vulnerabilities. The latter section covers attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will learn key techniques and functions to mitigate these risks.
Special attention is also paid to client-side security, addressing issues within JavaScript, Ajax, and HTML5. The curriculum introduces vital PHP extensions for cryptography (such as hash, mcrypt, and OpenSSL) and input validation (including Ctype, ext/filter, and HTML Purifier). Best practices for hardening PHP configurations (php.ini), Apache, and server settings are provided. Additionally, the course offers an overview of security testing tools and methods available to developers and testers, including security scanners, penetration testing frameworks, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.
Both the explanation of vulnerabilities and configuration guidelines are reinforced with hands-on exercises. These labs demonstrate the impact of successful attacks, illustrate how to apply mitigation strategies, and guide participants in using various extensions and tools effectively.
Learning outcomes
- Grasp fundamental concepts of IT security and secure coding
- Identify and prevent web vulnerabilities beyond the OWASP Top Ten
- Understand client-side vulnerabilities and secure coding standards
- Gain practical knowledge of cryptography
- Master the use of PHP's built-in security features
- Recognize common coding errors and learn how to avoid them
- Stay informed about recent security issues in the PHP framework
- Acquire hands-on experience with security testing tools
- Access resources and further reading on secure coding
Target Audience
Developers
Read more...
