 Hello, everyone. I'm J.S.L.B., working with Spring as IT manager. I'm playing with PHP more than a decade. So today, I'm just going to brief you what is about web security. OK. What is security? It's a process of securing the data over the web from the unauthorized access. So why we need security? Day by day, actually, the usage of the IT products is increasing, and securing the data and privacy is mandatory. So that's why we need security. And if you see, as a developer, we always think like we are writing a secure code. But in reality, still, many more sites are vulnerable. For example, from the latest list from the OVASP, this is the top 10 list, and there are many more. And I just brief you some of the few attacks in each layer, server layer, and application layer, and the transportation layer. The information leakage is one of the attacks in the server layer. The first one is the PHP information leakage. If you see, it is exposing which PHP version you are using. If the, suppose, for example, this version is vulnerable for some attacks, then it's a big issue. The hacker can easily hack your website. So always off this flag using the PHP INI. Next one is how you manage the configuration files. Always don't use .INI or .XML or any other file format to store the config variables. Always use the .PHP extension. Suppose you are exposing to the directory listing, then it's easy for the hackers to see what's the config variables and what are the values, important values. And one of the best way to store is store in the server with the environment variables. For example, always we store passwords, API keys, and so on. So always use these kind of best methods. Next thing, always separate your backup files from the root directory. If it is directly listing, it's enabled, then it's easy for the hackers to download the backup files. Next attack is the middleman, man in the middle attack. I think many of you know about this one. So for example, there are two systems, like A and B. They think they are communicating with each other directly, but an attacker secretly relies and can exchange the data. For example, they can hack the password or they can hack the cookies and so on. So what is the solution for this one? Always use the SSL. I'm just going to briefly how it works. The user recieves the secure site, and it will look for the DNS for the IP address of the web host. Once the records found, it will recieve the secure SSL connection to the web host. Then web host will send the certificate to the user, and it will enable the secure connection to transfer the encrypted data. So that's why most of the financial and banking sectors are using HTTPS as a mandatory one. Next one is the injection attacks. It's one of the attacks in the code level, in the application level. What is meant by injection attacks? Injection attacks are injecting some code into the web app to execute and manipulate the data. The first thing is the cross-site scripting. As you see, this is the number one in the Vovasp in the latest list. So what it is, cross-site scripting, is injecting a scripting code into our web app, which will run your client browser. I think more than 65% of the web are vulnerable to this attack. Next one is the scale injection attack. Nowadays, it's not very common, but it is very dangerous. Even they can delete your database itself. And code injection, it's injecting a source code into our web app to execute and manipulate the data. For example, eval is the PHP function. It's an eval function. Never, ever use this one in your code. There are a few more also, command injection, log injection, XML injection, and so on. You can read it later. How to prevent these kind of injections? Always, never, ever test your foreign input into your code. Always sanitize and validate your code. You can use the filter vests or filter input, XML entities, XML special cares. So those kind of things, you can use the validating the input. Next one is the interesting one, the SQL truncation exploit. How many of you know about this exploit? OK, I can see through your hands. What it is like. Take a scenario. I want to compromise a login. I think most of the websites will have an admin login. I want to compromise this login. I want to create another admin user, but in my own password, because I don't know what the admin password is. So how you can do it? Actually, in MySQL default mode, it will truncate, means it will truncate if you give more characters than the specified length. For example, you have an admin user in your web, in your app, and you are trying to create, always you check in the code like you already created an admin user or not. Suppose you are giving again. So while checking, it will say like already exist. So instead of that, when you can give admin and some five spaces, and after that, whatever it is, just give x or y something. So when you're trying to insert, it will insert your database. And suppose the length is 10 characters, then it will take admin and five spaces, then it will truncate whatever after it is. So now it is registered in your database. For MySQL, the admin and admin and the spaces are same. So when you're trying to log in, you check whether the username and password are there. So you will get, yes, you have the password it will go through, and you will get the data of the username with the admin. That's it, your admin account is compromised. So what's the solution for that one? You always use the stick mode in the MySQL and have any constraints on the column. OK, what you can do when your site is hacked? First thing is don't panic. Check for your error logs and access logs. It will give you more information what's going wrong. And next is the check for the suspicious files. And check for cron job and keywords like evals, system, curl, and so on. And check your database for some of the scripting or iframe keywords so that you can check it out. Any cross-site scripting injections are there. The final thing is prepare yourself to reinstall the entire server in the worst case. OK. How to prevent from the attacks? First thing is check the overs for the latest list of security vulnerabilities and how to prevent them. It will have always updated list. It's a best practice to check it. The next one is the use strong password hasings. I think MySQL 7 having a password underscore has, and they removed the user's salt because of the security. The next thing is the error reporting. Always off the report in the production and on in development, but in both cases, log your errors. The next thing is stay up to date. Always update your framework, OS, third party libraries, whatever you are doing. Suppose any dependency is not allowing to update. Please fix it immediately, later being hacked. And the next thing is read more about threats and best practices, what you can do. The last is try to run vulnerability scanners for getting what are the security threats in your app and how to prevent them. Thank you.