Web application security (Part 1)
summary
A hands-on PHP security workshop that shows concrete fixes: replace string-concatenated queries with prepared statements (demo of "1 OR 1=1" SQLi and Symfony repository one-liners), add CSRF tokens via forms, use password_hash (bcrypt) with adjustable cost and 20k+ iterations (benchmarks from 0.03s to ~2s), and avoid storing card data by using payment vaults. Live demos include Wireshark packet capture of HTTP credentials, Heartbleed-style memory leaks, 80 duplicated templates found in one app, and 27,000 exposed MongoDB instances.
AI-written summary · about
chapters (14)
- 0:00Welcome and course overview
- 0:47Application hardening basics
- 20:08Coding vulnerabilities introduction
- 22:16SQL injection flaws
- 36:40Buffer overflows explained
- 42:00Secure cryptographic storage
- 1:01:21Security questions and credit cards
- 1:09:14Insecure communications risks
- 1:13:11Improper error handling
- 1:16:00Cross-site scripting prevention
- 1:25:52Improper access control
- 1:36:58Cross-site request forgery
- 1:56:30Broken authentication demo
- 2:05:05Default configurations and updates
related talks
55mWeb Application Security: Winning When The Odds Are Against You
52mPractical Security in Web Applications
01h 02mCode Review For Security
01h 04mWeb Security And You
59mPractical Security for Web Applications
51m10 things developers need to know about web application security
10mIntroduction to web security
01h 01mSecurity: From basic principles to PHP specifics