DEV300
Hardening PHP Web Apps

Overview

Web applications are routinely the source of many security vulnerabilities, especially as more and more move to the cloud. However, this is despite the fact it is often simple to fix most web applications vulnerabilities, before the code is released into the wild. The ‘Hardening PHP Web Apps’ course walks students through the list of the OWASP Top Ten vulnerabilities common in web application code and demonstrates various methods of secure coding to harden web applications. Specifically, the course focuses on examples A1 through A8 of the top ten list.

Each module contains instructor-led video lecture content to introduce the vulnerability and explores various mitigation measures, specific to each vulnerable code example. Each module also includes an interactive hands-on lab component, in which the student has the chance to experiment with real solutions to discover why some seemingly adequate code remediations are insufficient and others are more appropriate. The student is then challenged to complete a demanding “capstone lab” exercise that encourages the student to explore a novel web application and remedy sections where it is vulnerable.

Upon completion of this course, the student will understand how to identify many common web application vulnerabilities and gain valuable practical skills via engagement in meaningful web application security control measures.

Objective

Examine a web application design and implementation and identify potential vulnerabilities. Remediate the vulnerability by modifying the underlying code.

Topics

• Lab 1.1: Stopping SQL Injection with validation and prepared statements
  Lab 1.2: Stopping OS Command Injection with Data Validation

• Lab 2.1: Implementing Proper Authentication in PHP
  Lab 2.2: Enabling Google Authenticator in a PHP Web Application

• Lab 3.1: Password Hashing in PHP
  Lab 3.2: Proper error handling in PHP

• Lab 4: Defending against XXE in PHP

• Lab 5.1: Basic Access Control in PHP
  Lab 5.2: Preventing Directory Traversal and LFI with Whitelisting in PHP

• Lab 6: Securing the PHP configuration

• Lab 7: Preventing XSS in PHP

• Lab 8: Secure Serialization in PHP

• Lab 9.1: Defending Against CSRF in PHP
  Lab 9.2: Securely Handling File Uploads in PHP

• Lab 10: Capstone: Securing a Web Application From Top to Bottom in PHP