Hacking you PHP Application 

“ 2 

Key concepts 3 Confidentiality Integrity Availability 

Risks Are you aware? 4 

5 ✓ Attacker must succeed once ✓ Attacker can choose the weakest spot ✓ Attacker can leverage zero-days ✓ Attacker can play dirty ✘ Defender must get it right all the time ✘ Defender must defend all places ✘ Defender can only defend against known attacks ✘ Defender needs to play by the rules Attackers have advantage over defenders 

6 Threat Agents Attack Vectors Security Controls Technical Impacts Business Impacts Security Weaknesses 

Where The Attacks Come From? 7 your office 

1. Injection 2. Broken Authentication 3. Sensitive Data Exposure 4. XML External Entities (XXE) 5. Broken Access Control OWASP Top 10 Application Security Risks - 2017 6. Security Misconfiguration 7. Cross-Site Scripting (XSS) 8. Insecure Deserialization 9. Using Components with Known Vulnerabilities 10. Insufficient Logging & Monitoring 8 

Approaches 9 Can I play, Daddy? Bring ‘em on! I am Death incarnate! 

Apprentice 10 

Wizard 11 

Black Sorcerer 12 

13 

Security process is easy Keep Security Simple 14 

Let’s review some concepts Filter inputs, Escape outputs Minimize attack surface area Least privilege Defense in depth Fail securely Avoid security by obscurity 15 

thanks! Any questions? In-secure: https://github.com/EvandroMohr/in-secure Juice store: https://github.com/bkimminich/juice-shop WebGoat: https://github.com/WebGoat/WebGoat DVWA: https://github.com/ethicalhack3r/DVWA 16