🛡️IT Security Summit

🏠 Application Pages

ℹ Home (HTTP) Without TLS ℹ Home (HTTPS) With TLS ℹ Home (HTTPS + PHP) With TLS ℹ Database Setup Initialize DB

🔍 Injection Attacks

⚠ SQL Injection Database manipulation ⚠ SSRF Attack Server-side requests ⚠ Command injection Shell scripting hazards

🔐 Authn/z Attacks

⚠ IDOR URL manipulation ⚠ Timing side-channel Password guessing

🚨 Validation & escaping

⚠ PHP XSS Demo Reflected XSS ⚠ HTML XSS Demo DOM manipulation ⚠ Validation Client and server-side validation

🛡️ CSRF Protection

⚠ Vulnerable Form No CSRF protection ✓ Protected Form Token protection ⚠ Attack Generator Create CSRF attacks

🌐 Cross-Origin Requests

ℹ CORS Client Frontend demo ✓ Blocked Requests Secure policy ⚠ Permissive Policy Allows all origins

🖼️ UI Redressing

ℹ Frameable Content Innocent target ⚠ Clickjacking Framing attack

🍪 Headers & Cookies

ℹ Cookie Security Secure attributes ✓ CSP Demo Content security ✓ Reporting Triggering the reporting API

🔧 Virtual Host Configurations

Use vhost <number> command to switch between these nginx configurations:

Vhost number	Description
`0`	Basic HTTP-only site
`1`	Adds ACME folder location for HTTP auth
`2`	Adds HTTPS config, basic certificate settings. Must have a certificate before enabling.
`3`	Adds TLS session cache, Mozilla "old" cipher suites
`4`	Switches to Mozilla "intermediate" cipher suites, stronger DH params & curves
`5`	Adds security headers, CSP, HSTS, Reporting
`6`	Change to TLSv1.3 only
`7`	Add HTTP/3 support
`8`	Add PHP support
`9`	Final config - Secure CSP, NEL, reporting