In this video we will discuss what does the course cover.
The first chapter is the nature and scope of the problem.
We will be discussing First of all what is the threat how to analyze the threat how bad is it what types
of threats are out there.
What specific to HP and how can you get some help.
The next video talks about what are the consequences when a web site is not protected against attack.
You will learn that the consequences can include financial loss loss of service identity theft and Web
site infection.
The next video discusses what are the most common forms of attack.
You will learn about cross-site scripting remote code injection session highjacking fixation and request
forgery.
And finally the famous Escudo injection attack in this series of videos.
These attacks will actually be demonstrated for you using the sample suites complete Web site.
Then you will learn about what are the most common vulnerabilities that attackers can exploit.
These include unplanned information disclosure where attackers probe your web site and try to discover
error messages in other accidental pieces of information that you might have forgotten exist we'll look
at something called predictable resource location insufficient authorization improper access controls
mis configuring your server and mishandling file uploads.
The next video will cover the various resources which are available.
These resources fall into two categories.
Web resources and also resources that cover software specific considerations.
The lamp for this chapter will have you practice various hacking techniques on the included suites complete
Web site.
You will learn how to execute a reflected cross-site scripting attack exploiting an information disclosure
vulnerability.
Executing a code injection attack and exploiting a file upload vulnerability and finally executing in
Eske fuel injection attack.
The purpose of this lab of course is not to turn you into a hacker but to give you insights as to how
the attacks are actually accomplished.
The next chapter covers understanding filtering validation in output escaping.
It's important to understand what these terms mean.
And of course how you can implement them in HP in the first video in this chapter.
You will learn what is filtering validation output escaping and why use these.
And finally you will gain an understanding as to why you would want to filter validate an escape output.
This video will also cover the differences between filtering validation and output escaping the next
video.
We'll discuss common HP filtering functions and techniques.
This will include changing the data type using commands such as strip tags stirre replace and P-Orridge
replace.
There is a video which covers the most common page.
The output escaping functions H.M. entities NHT male special characters are featured next.
There's a separate video on a special command called Filter var which will do both filtering and validation.
You'll be looking at common validation filters which allows filter var to serve as a validation mechanism.
The sanitization filters allow filter var to work as a filtering mechanism in the lab.
You will be working with the raw suite's complete Web site to filter and validate posted form data you'll
be modifying the ADD member form adding validation and filtering for all fields.
You'll then an appropriate validation messages and make sure that invalid entries are not added to the
database.
You will then be able to test using the techniques demonstrated in earlier videos.
The next chapter deals with preventing the most common forms of attack as mentioned before to prevent
cross-site scripting attacks you will be analyzing techniques regarding stored and reflected cross-site
scripting and learning how to escape output to prevent these sorts of attacks.
You will also learn how to protect forms as well as incorporating new HCM L5 features in the video on
preventing session hijacking and forgery attacks.
You will learn how to regenerate session IDs how to provide a Lagat option how to set up a timer to
keep your sessions short.
And finally how to build a profile of the user using external factors which reduces your reliance on
the sole point of vulnerability namely the session identifier in the video remote code injection attacks.
You'll be looking for vulnerabilities surrounding the include statement we'll be examining possible
vulnerabilities with a functionality called autoloading the PDP ionize settings will be examined.
And finally there'll be a discussion on some remote or more obscure forms of injection attack in the
lab for this chapter.
You will be protecting the shopping cart on the Sweet's complete Web site against cross-site scripting
attacks.
You will be protecting the Web site against character based attacks by setting a specific character
set of UTF 8 you will be securing the log in process against session hijacking.
And finally you'll implement some protections to prevent remote code injection.
The next chapter deals with protecting against common web site vulnerabilities.
The video on protecting against unplanned information disclosure discusses concepts such as proper error
handling reporting and logging.
You'll look at how to shut off the display of errors techniques on exception handling in object oriented
programming will be discussed.
And finally there's a discussion on improving code efficiency.
The video on protecting against predictable resource location will discuss things such as changing open
source defaults staying away from obvious names what HP ionize settings should and should not be set.
And also the default PDP ionize settings which should be changed.
The video on protecting against insufficient authorization will discuss improper access to secure areas
of the Web site and also improper authority for low level accounts.
There is also a video on protecting against improper access control.
In this video we will discuss things such as the proper storage of passwords password controls creating
new and resetting old passwords and the logic which you should follow.
And finally a discussion and Pietsch be hashing and encryption extensions.
The video on avoiding misconfiguration discusses things such as file system rights various PDP ionize
security settings and also running P-H as a CGI binary.
In this chapter there's also a video on protecting file uploads.
You will learn which Pietsch be ionize settings are appropriate to set how to implement safety checks
sanitising the file name.
Moving the uploaded file to a secure location implementing h himself features in Finally a number of
other safety measures which should be taken in the lab for this section.
You'll be improving the security on the Sweet's complete Web site to prevent exploits of common vulnerabilities.
You'll be tightening up the Web site to protect against information disclosure insufficient authorisation
predictable resource location and also you will be setting up proper access controls.
You will be reworking the configuration of the Web site and finally in the contact form implementing
proper controls for file uploads.
The final full chapter in this collection discusses protecting against as fuel injection attacks.
You will learn how to protect a minuscule database.
The discussions will include using an up to date extension not allowing direct access over the internet.
Implementing proper database user access controls and finally reviewing default settings.
There is a video on implementing database escaping and quoting you will learn what is database escaping
or quoting.
What are the benefits and how can these be implemented in HP.
There is another video on using prepared statements.
You will learn what is a prepared statement.
What protection does it provide and how can you implement a prepared statement in HP in the lab for
this chapter.
You will be protecting a minuscule database against as cool injection again in the suites complete Web
site.
You'll be rewriting certain model classes in order to use the latest extension and also to implement
prepared statements and database escaping.
In quoting the final video discusses the author you'll be learning about the author's work.
Programming languages used operating system environments and protocols education and certifications.