A curated list of resources for learning about application security.
Maintained by Paragon Initiative Enterprises with contributions from the application security and developer communities.
This README file is dynamically generated from the data/ directory.
See src/compiler.php for more information.
- General
- PHP
Released: February 25, 2014
Advice on cryptographically secure pseudo-random number generators.
Released: August 6, 2014
A post on Crackstation, a projecy by Defuse Security
Released: May 3, 2014
Mentions many ways to make /dev/urandom fail on Linux/BSD.
Released: September 27, 2011
Great introduction to Web Application Security; though slightly dated.
Released: March 15, 2010
Develops a sense of professional paranoia while presenting crypto design techniques.
Learn about application security by attempting to hack this website.
Where hackers and security experts come to train.
Self-assessment quiz for web application security
Secure passwords in several languages/frameworks.
A list of security news sources.
Video courses on low-level x86 programming, hacking, and forensics.
Showcasing bad cryptography
The top ten most common and critical security vulnerabilities found in web applications.
It's All About Time (2014)
Released: November 28, 2014
A gentle introduction to timing attacks in PHP applications
Released: April 21, 2015
Discusses password policies, password storage, "remember me" cookies, and account recovery.
Released: April 22, 2013
Padriac Brady's advice on building software that isn't vulnerable to XSS
Released: November 23, 2011
Though this article is a few years old, much of its advice is still relevant as we veer around the corner towards PHP 7.
PHP data encryption primer (2014)
Released: June 16, 2014
@timoh6 explains implementing data encryption in PHP
Symmetric-key encryption library for PHP applications. (Recommended over rolling your own!)
If you're using PHP 5.3.7+ or 5.4, use this to hash passwords
Useful for generating random strings or numbers
The blog of our technology and security consulting firm based in Orlando, FL
A blog about PHP, Security, Performance and general web application development.
A weekly newsletter about PHP, security, and the community.