Secure coding in PHP

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks.


Web developers, architects, and testers 


Preparedness: Advanced Web application 

Course outline:

A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. Hardening best practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers. Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools.

  • Vulnerabilities, attacks and mitigationsstrong
    OWASP top 10 and other frequent vulnerabilities: SQL Injection and other injection flaws, including CSS injection, command injection and cookie injection, Cross-Site Scripting: persistent and reflected XSS, XSS through HTML/CSS (base injection), protections in browsers, Cross-Site Request Forgery (CSRF), vulnerabilities in session management, session handling, malicious file execution, insecure direct object reference, uploading executable files, problems with error and exception handling, PHP type comparison, improper use of cryptographic features, problems with random, weak PRNG, challenges of password management, cracking hashed passwords with search engines, file and SQL race conditions, concurrency and session handling in PHP, open_basedir race condition hacking, denial-of-service by magic float numbers, hashtable collision attack.
  • PHP-specific vulnerabilities and protections: 
    functions to be used for input validation, PHP extension for input validation (CType, Filter, HTML Purifier, OWASP ESAPI), remote code execution, path traversal in PHP, MySQL validation errors, variable scope problems, local variable pollution, filtering file uploads, environment manipulation. Client-site security. JavaScript same origin policy, global object, authentication and password management in JavaScript, obfuscating JavaScript code, history stealing, XSS DOM in JavaScript, ClickJacking. Ajax security, XSS and CSRF in Ajax, example: explaining the MySpace worm. XSS and ClickJacking in HTML5, form tampering, history tampering, cross-document messaging. PHP security services – using hash, mcrypt, OpenSSL, CType, ext/filter, HTmL Purifier, OWASP AntiSamy, OWASP ESAPI, suhosin. PHP environment – server configuration, PHP configuration (php.ini settings), safe mode, Appache configuration, mime types. Hardening.
  • Vulnerability tools 
    security scanners (Nikto/Wikto, Nessus, w3af, wapiti), SQL injection tools (SqlMap, SqlNinja), knowledge sources (CVE, NVD, BSI, SHIELDS), Metasploit penetration testing resources, finding security holes (Google hacking, SiteDigger, FSDB, GHDB), sniffers (Wireshark), proxy servers (BurpSuite, Paros proxy), fuzzing robustness and security testing tools, static source code analyzers (RIPS, Pixy).
  • Exercises: 
    exploiting SQL injection step-by-step; crafting Cross-Site Scripting attacks through both reflective and persistent XSS; committing Cross-Site Request Forgery (CSRF); malicious file execution; insecure direct object reference; uploading and running executable code; cracking hashed values with search engines; information leakage through error reporting. Using w3af, wapiti, sqlmap, CVE, google hacking databases, WireShark, Burp Suite and Pixy.

Other relevant courses