Secure Coding with PHP

Secure Coding with PHP

Introduction

  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn to use various security features of PHP
  • Get information about some recent vulnerabilities of the PHP framework
  • Learn about typical coding mistakes and how to avoid them
  • Get practical knowledge in using security testing tools
  • Get sources and further reading on secure coding practices

Course Outline

Module 1 – IT security and secure coding

  • Nature of security
  • IT security related terms
  • Definition of risk
  • Different aspects of IT security
  • Requirements of different application areas
  • IT security vs. secure coding
  • From vulnerabilities to botnets and cyber Crime
  • Classification of security flaws

Module 2 – Web application vulnerabilities

Module 3 – Basics of cryptography

  • Cryptosystems
  • Symmetric-key cryptography
  • Other cryptographic algorithms
  • Asymmetric (public-key) cryptography
  • Public Key Infrastructure (PKI)

Module 4 – Client-side security

  • JavaScript security
  • Ajax security
  • HTML5 Security

Module 5 – PHP security services

  • Cryptography extensions in PHP
  • Input validation APIs

Module 6 – PHP Environment

  • Server configuration
  • Securing PHP configuration
  • Environment security
  • Hardening
  • Configuration management

Module 7 – Advices and principles

  • Matt Bishop’s principles of robust programming
  • The security principles of Saltzer and Schroeder

Module 8 – Input validation

  • Input validation concepts
  • Knowledge sources
  • Secure coding sources – a starter kit
  • Remote PHP code execution
  • MySQL validation errors – beyond SQL Injection
  • Variable scope errors in PHP
  • File uploads, spammers
  • Environment manipulation

Module 9 – Improper use of security features

  • Problems related to the use of security features
  • Insecure randomness
  • Weak PRNGs in PHP
  • Stronger PRNGs we can use in PHP
  • Password management – stored passwords
  • Some usual password management problems
  • Storing credentials for external systems
  • Privacy violation
  • Improper error and exception handling

Module 10 – Time and state problems

  • Concurrency and threading
  • Concurrency in PHP
  • Preventing file race condition
  • Double submit problem
  • PHP session handling
  • A PHP design flaw – open_basedir race condition
  • Database race condition
  • Denial of service possibilities
  • Hashtable collision attack

Module 11 – Using security testing tools

  • Web vulnerability scanners
  • SQL injection tools
  • Public database
  • Google hacking
  • Proxy servers and sniffers
  • Exercise – Capturing network traffic
  • Static code analysis