Workshop in English - US at Longhorn PHP 2026
Track Name:
Main Ballroom
View Slides: https://gamma.app/docs/Break-It-Then-Fix-It-su5ecshp4l29j1ihttps://gamma.app/docs/Break-It-Then-Fix-It-su5ecshp4l29j1i
View Slides: https://speakerdeck.com/ericmann/break-it-then-fix-it-an-owasp-top-10-workshop-for-php-developers
Checkout the code: https://github.com/ericmann/rampart
Short URL: https://joind.in/talk/9a9db
(QR-Code (opens in new window))
Reading about injection teaches you the words. Exploiting it teaches you the lesson. This hands-on tutorial walks every OWASP Top 10 category inside a deliberately vulnerable PHP app—you'll find the bug, exploit it yourself, then fix it properly. We cover injection, broken access control, authentication failures, SSRF, insecure deserialization, and the rest, with concrete mitigations for Laravel, Symfony, and WordPress. You leave with muscle memory and a hardening checklist—not just awareness.
Comments
Please login to leave a comment
Excellent tutorial by Eric. He was very well prepared, explained things clearly, and had lots of great examples. The code repo and project were very helpful to see what issues look like, and how to fix them. Made 3 hours go by so fast, and covered very important and relevant information about security. Top notch!
Loved the talk. There were some great examples, and it gave me a lot to think about regarding what random inputs I should be putting in my tests. :-) My only criticism was that it was a lot to try to do in 3 hours, but he already knew that. :-)