Overview What You Will Learn Curriculum Instructor

Course Overview

What You Will Learn

  • How to secure PHP REST APIs against the most common vulnerabilities.
  • The importance of secure error handling and response management in API development.
  • How to manage API keys securely and prevent unauthorized access.
  • What are the main XML format vulnerabilities (DoS, XXE, RCE) and how to defense against it.
  • How to prevent XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery) attacks in your APIs.
  • How to mitigate SQL Injection, Command Injection, and other injection-based attacks.
  • How to deal with SSTI (Server-Side Template Injection), Path Traversal.
  • Why Command Injection is so dangerous by handling zero-day advanced attack by your own hands.

Program Curriculum

  • Introduction
  • About Me and Cybersecurity Experience
  • Course Structure & How to Finish It 2x Faster If You're Short on Time

  • Introduction to REST Architecture and Principles
  • Local Environment Skeleton
  • Chapter 2 Quiz

  • Theory: Lack of REST API Formalization
  • X-HTTP-Method-Override Vulnerability Practice Example
  • Best Practices to Avoid Problems with REST Formalization, Code Fixes - Part 1
  • Best Practices to Avoid Problems with REST Formalization, Code Fixes - Part 2
  • Chapter 3 Quiz

  • Theory: API Documentation and Security Implications of Its Exposing
  • Practice: How to Manage API Accessibility - Part 1, Swagger
  • Practice: How to Manage API Accessibility - Part 2, Dotenv + Route Refactor
  • Practice: How to Manage API Accessibility - Part 3, API Doc Class
  • Practice: How to Manage API Accessibility - Part 4, Tests + Devops Layer
  • Chapter 4 Quiz

  • Theory: Debug Information as Security Vulnerability
  • Practice: Debug Mode Setup
  • Theory: Error Handling and Response Management
  • Practice: Error Handling - Part 1
  • Practice: Error Handling and Final Recommendations - Part 2
  • Chapter 5 Quiz

  • Theory: API Keys Vulnerabilities and Best Practices
  • Practice: Move API Key to env, Security Improvements
  • Announcement: Change of Strategy
  • Chapter 6 Quiz

  • Theory: REST API Structured Data Formats and Their Security Risks
  • Practice: Rebuild App to Use XML Format
  • Practice: Billion Laughs Attack
  • Practice: Quadratic Blowup Attack
  • Practice: XXE
  • Practice: Object Injection Resulting in Remote Code Execution (RCE)
  • Practice: Best Security Practices
  • Chapter 7 Quiz

  • Theory: Introduction to Cross-site Scripting (XSS)
  • Practice: Reflected XSS
  • Practice: Stored XSS - Part 1
  • Practice: Stored XSS - Part 2
  • Practice: File-based XSS
  • Chapter 8 Quiz

  • Theory: Cross-site Request Forgery (CSRF) with SSRF
  • Practice: CSRF - Part 1
  • Practice: CSRF - Part 2
  • Chapter 9 Quiz

  • Theory: SSTI (Server-side Template Injection)
  • Practice: SSTI - Part 1
  • Practice: SSTI - Part 2
  • Chapter 10 Quiz

  • Theory: Path Traversal Vulnerability in Cybersecurity
  • Practice: Path Traversal attack and How to Prevent It
  • Chapter 11 Quiz

  • Theory: Command Injection - Main Attack Vectors
  • Practice: Command Injection - Part 1, Environment
  • Practice: Command Injection - Part 2, Zero-day Vulnerability
  • Summary - Anti-zero Days Measures and Sad Realities
  • Chapter 12 Quiz

  • Practice: Local env - MySQL, phpMyAdmin, Base Code Structure
  • Practice: SQL Injection Class
  • Practice: Introduction to SQL injection
  • Practice: Union-based SQL Injection
  • Practice: Blind Content-based SQL Injection
  • Practice: Blind Time-based SQL Injection
  • Theory: SQL Injection Consequences and Best Practices
  • Practice: Apply Best Security Practices Against SQL Injection
  • Chapter 13 Quiz

  • Theory: PHP Deserialization
  • Practice: Exploiting Deserialization Vulnerabilities - Part 1
  • Practice: Exploiting Deserialization Vulnerabilities - Part 2
  • Practice: Exploiting Deserialization Vulnerabilities - Part 3
  • Practice: Exploiting Deserialization Vulnerabilities - Part 4
  • Chapter 14 Quiz

  • Cheat Sheet: Authentication, Authorization & Session Management Vulnerabilities
  • Practice: Enumeration Attacks - Part 1
  • Practice: Enumeration Attacks - Part 2
  • Practice: IDOR - Part 1
  • Practice: IDOR - Part 2
  • Chapter 15 Quiz

  • Theory: JWT Vulnerabilities
  • Practice: Best Practices for JWT Security - Part 1
  • Practice: Best Practices for JWT Security - Part 2
  • Chapter 16 Quiz

  • Theory: Rate Limiting and Throttling
  • Practice: Rate Limiting
  • Chapter 17 Quiz

  • Theory: Webhooks
  • Practice: Webhooks
  • Chapter 18 Quiz

  • Chapter 19: Hidden Files and CORS
  • Hidden Files
  • CORS Theory
  • CORS Practice
  • Chapter 19 Quiz
Load more modules

Instructor

Sergii Demianchuk

Sergii Demianchuk is a software engineering professional with nearly 20 years of experience in building scalable applications and cloud-based solutions. As the CTO and System Architect at Clicktrans, one of Europe's largest transport marketplaces, he specializes in system architecture, machine learning, big data, DevOps, cybersecurity, and AWS. His expertise spans technologies including Python, PHP, Java, JavaScript, Docker, Flask, Spring, Vue.js, MySQL, Redis, and Elasticsearch.

Join over 1 Million professionals from the most renowned Companies in the world!

certificate

Choose the Pro Plan That Fits Your Learning Journey

Invest in your future with flexible Pro subscription plans. Whether you're starting your cybersecurity journey or expanding your expertise, choose the membership duration that works for you and gain access to our complete learning platform.

Monthly Plans
Annual Plans
Save 20% with our annual plans!

Pro

Ideal for continuous learning, offering extensive resources with 900+ courses and diverse Learning Paths to enhance your skills.

$ 599.00
Billed annually or $69.00 billed monthly
Get Started Now
Start your 7-day trial for $1

What is included

  • Access to 900+ Premium Short Courses
  • 70+ Structured Learning Paths
  • Validation of Completion with All Courses and Learning Paths
  • New Courses Added Every Month
Early Access Offer

Pro +

Experience immersive learning with Practice Labs and CTF Challenges for comprehensive skill-building.

$ 699.00
Billed annually or $79.00 billed monthly
Get Started Now
Start your 7-day trial for $1

Everything in Pro and

  • 600+ Practice Labs with Guided Instructions
  • 400+ CTF Challenges with Detailed Walkthroughs
  • New Practice Labs and Challenges Added Every Month

Related Courses

  • Bootstrap 4 Quick Website Bootstrap Components Course
    Short Course

    Bootstrap 4 Quick Website Bootstrap Components Course

    Software Development

    Explore the basics of Bootstrap and learn to create a website...

    $49.99

    Beginner

    1 hr 30 m

  • CCNA - Understanding Routers and Switches
    Short Course

    CCNA - Understanding Routers and Switches

    Security Architecture and Operations

    A comprehensive guide to understanding the in-depth functioni...

    $49.99

    Intermediate

    2 hr 0 m

  • The Complete Full-Stack JavaScript Course
    Short Course

    The Complete Full-Stack JavaScript Course

    Software Development

    Learn full-stack web development using JavaScript (ReactJS, N...

    $79.99

    Beginner

    24 hr 17 m

  • React.JS for Ecommerce: Building a Store with React.JS
    Short Course

    React.JS for Ecommerce: Building a Store with React.JS

    DevSecOps

    From React.js Fundamentals to Crafting an Online Storefront

    $49.99

    Advanced

    3 hr 30 m

  • CISSP Certification Domains 5, 6, 7, and 8 Video Training
    Short Course

    CISSP Certification Domains 5, 6, 7, and 8 Video Training

    Cybersecurity

    This course is ideal for individuals who desire to pass the I...

    $69.99

    Intermediate

    6 hr 30 m

  • Helm 3 - Package Manager for Kubernetes
    Short Course

    Helm 3 - Package Manager for Kubernetes

    Software Development

    A must tool for every DevOps engineer

    $49.99

    Intermediate

    1 hr 27 m

  • Learn Ethical Hacking by Hacking Real Websites Legally
    Short Course

    Learn Ethical Hacking by Hacking Real Websites Legally

    Vulnerability Assessment and Pentesting

    Fun way to learn ethical hacking by playing online hacking ga...

    $69.99

    Beginner

    4 hr 18 m

  • Mastering Ansible Playbooks: Debugging and Security
    Short Course

    Mastering Ansible Playbooks: Debugging and Security

    Software Development

    Securing and Automating Linux and Windows Systems with Advanc...

    $99.99

    Advanced

    5 hr 34 m

1 50
View all