Secure Programming

	See also...  Organization of the courses  Training sessions planning  Hands on PHP secure programming  E-learning PHP secure programming
Goals  Duration  Instructor(s)  Pre-requisite for attendants  Teaching method  Related courses  Material  Agenda  Methods of inscription

	Dates of the coming sessions: No session in the coming months Dates subject to modification without prior notice. The sessions will only take place if the number of registered attendants is high enough.

 

More and more critical applications have to be put on the Internet to share confidential data. Decreasing writing times and high specification levels do not help to write solid and secure applications.

In these conditions, each bug can become a security vulnerability, allowing attackers to gain access to the application or the system by misappropriating the the program, or by performing remote code execution.

The aim of this course is to point out the main, known and generic security problems that can appear with C/C++, Perl and PHP coding.

This course introduces the vulnerabilities by describing causes and explaining how to prevent them. It also focuses on how to write a secure network application using Unix security possibilities.

1 day.

This course is meant for C/C++, Perl and/or PHP developers and project managers.

Lecture, with numerous examples of practical applications.

Web Servers and applications Security

• Introduction sur les vulnérabilités
• Les zero days
• Les vulnérabilités standards
• Gestion de la mémoire
• détail des buffer overflows, format strings, ...
• La programmation système
• environnement UNIX
• les droits
• Les appels de fonctions (standard, système)
• injection de librairies
• limitation des droits
• Les services réseaux
• rappel TCP/IP
• Les démons (fonctionnement, inetd, ...)
• La séparation des privilèges
• fonctionnement
• modes de communication
• techniques à suivre
• exemples
• Le protocole HTTP
• fonctionnement
• les formulaires
• l'authentification
• SSL
• Fonctionnement
• Authentification par certificats
• Les attaques HTTP
• Cross-site scripting
• injection de session
• injection SQL, Ldap
• Les spécificités des langages interprétés
• shell
• Perl
• php
• Conclusions

For registering an HSC course, please contact our training department by phone : +33 141 409 704 or by email at formations@hsc.fr, with first and last name of every student, your postal address and your company VAT number. Thoses informations enable us to send your the training agreement. The training agreement must be return agreed with signature and company stamp with you purchase order, at least 6 days before the course. The purchase order should precise your billing address and our payment regulations : net 30 days from our invoice date. Registration is completed as soon as we received those two documents.