Certified Secure Coder- PHP (CSC- PHP)

Explore command injection, or arbitrary code execution, from malicious input in cookies, forms, or headers that trigger system or shell commands.

Explore command injection via a dns lookup feature. Craft inputs using pipes in a post request to execute shell commands and reveal information.

Demonstrates a command injection prevention approach by sanitizing user input and using an escape shell arguments function to neutralize dangerous commands, showing how the prevention mechanism blocks injected payloads.

Explore ex-MIL and ex-parte injections in XML and XPath, highlighting external entity attacks and the role of input validation and disabling external entity resolution.

Demonstrates an XPath injection attack by exploiting login credentials through an or 1=1 condition to bypass authentication and reveal the first user in the XML files used by login page.

Demonstrates a server-side input filtering approach to prevent ex-parte injection by removing special characters, validating user inputs, and verifying login functionality after applying the filter.

Explore how PHP code injection arises from improper input handling and lacking validation, risking confidentiality, integrity, and accessibility, and learn mitigations like input validation and input sanitization.

Explore a PHP code injection vulnerability by inspecting a vulnerable function that echoes user input, then demonstrates exploitation with netcat to establish a reverse shell.

Explore how to prevent php code injection by handling malicious user input and mitigating attackers' attempts. The lecture demonstrates identifying an injection attempt and achieving success in mitigating the attack.

Explore PHP object injection from unsanitized input and unserialize, exploiting magic methods like __construct and __destruct, risking defacement, data exposure, and credential theft; apply validation and secure sdlc.

Explore a PHP object injection demo that shows how serialized data and crafted payloads influence backend processing, cache, and file deletion, highlighting input handling flaws.

Explore the second demonstration of PHP object injection, demonstrating how object injection can be executed to access PHP data and reveal PHP functionality.

Learn to prevent PHP object injection by locating risky functions in header and PSP files, replacing them with safer forms, saving changes, and testing the mitigation.

Explore how SSI and SSA injection exploit directives in pages to reveal sensitive data or run commands via user input, with mitigations like disabling SSI and encoding input.

Explains an ssi injection demo that reveals an ip address, a first name, and a last name, tests various payloads, and demonstrates remote command execution via netcat.

Demonstrates mitigating SSI injection by filtering special characters from $first name and $last name using the SDMI special task function and validating that inputs are sanitized during testing.

Explore ldap injection risks caused by weak input sanitization, show how attackers modify statements, and outline mitigations like input validation, sanitization, regular expressions, and restricting directory access.

Explore HTML injection and cross-site scripting risks when input is not handled properly; learn encoding, input sanitization, and validation to prevent such attacks.

See an HTML injection demo in a basic blogging app. Attackers can craft a phishing page to capture a victim’s username and password during login.

Explore broken authentication and session management from the OWASP top 10, focusing on unique server-generated session IDs, logout invalidation, secure transmission, and proper password practices.

Explore an insecure session management example, where altering a value on a page locks or unlocks access, illustrating how broken authentication can lead to an exploit.

Secure the PHP flow by updating the session check to verify authorization and lock pages accordingly. Replace insecure checks with a robust session validation to demonstrate defense in practice.

Explore cross-site scripting (XSS), an injection that delivers malicious payloads into web pages. See how input validation and sanitization prevent reflected, stored, and other XSS methods.

Demonstrates reflected cross-site scripting by injecting a script into a reflected page, showing how browser-executed code steals cookies through social engineering in a crafted link.

Demonstrates a reflected cross-site scripting vulnerability via a get request by echoing user input such as first name and last name, and showing script injection, alerts, and cookie exposure.

Demonstrate a reflected XSS attack in a post form by entering first name and last name, inspecting the page, and injecting a script that alerts the cookie.

Understand stored cross-site scripting, where attackers store malicious scripts in a database that are displayed to users and executed in their browsers.

Explore a stored cross-site scripting demo on a blog post, showing how user input saved to a database is reflected on the page and can trigger a script alert.