Web application security (Part 2)
summary
Demonstrates concrete PHP checks and fixes: run composer security advisories via curl to spot known package CVEs; disable DTD/entity loading to stop XML external entities (billion‑laughs and zip bombs); treat JSON as safer, but never assume. Shows an exploit chaining PHP unserialize to trigger a Symfony FilesystemAdapter destructor to delete config files, and remote entity gists that cause stored XSS and arbitrary file reads. Recommends disabling entity/object parsing, running deserialization at low privileges, whitelist network calls, and add logging/alerts (noting 191 days average breach discovery).
AI-written summary · about
chapters (15)
- 0:00Intro
- 4:30Zip Bump
- 6:51External entities
- 24:26The solution
- 33:24Insufficient logging and monitoring
- 39:35Database corruption
- 40:25Brute force attacks
- 44:15Log management
- 45:37Errors
- 48:23Monitoring
- 50:08Vulnerability management
- 51:26Response Plan
- 52:00Response Plan Example
- 54:49Threat Modeling
- 57:46Threat Modeling Process
related talks
10mIntroduction to web security
52mPractical Security in Web Applications
01h 04mWeb Security And You
01h 02mCode Review For Security
43mPHP Security, Redefined
55mWeb Application Security: Winning When The Odds Are Against You
01h 01mSecurity: From basic principles to PHP specifics
35mPHP is evil (Defensive programming)