Test-Driven Security: A Vulnerability Is a Missing Test

In many projects, security is treated as a point-in-time audit: checked once, fixed once, and quickly forgotten. This training takes a different stance: a vulnerability is nothing more than a missing test. You work in a deliberately vulnerable PHP application and, for each weakness, run through a three-step cycle – find and exploit the flaw manually by capturing the flag, express the security requirement as an automated PHPUnit test, and change the code until that test turns green.

The punchline: the "flag" is not proof of a break-in, but a green test that prevents every future break-in of the same kind. The Common Weakness Enumeration (CWE) provides the scaffolding: each class of vulnerability becomes a station you can solve independently. This way you anchor security where it lasts – in your test suite.

• The three-step cycle: capture the flag, reproduce as a red test, fix until green
• Cross-Site Scripting, SQL injection, and OS command injection (CWE-79, CWE-89, CWE-78)
• Path traversal and unrestricted file upload (CWE-22, CWE-434)
• IDOR as well as missing and improper authorization (CWE-639, CWE-862, CWE-285)
• Cross-Site Request Forgery, insecure deserialization, and SSRF (CWE-352, CWE-502, CWE-918)
• Choosing the right test level: a unit test where the flaw lives in a class, a functional test at the application boundary
• Testing authorization in both directions: permitted access keeps working, unauthorized access is rejected

The training is aimed at experienced PHP developers and teams who want to treat security not as a one-off audit but as a permanent part of their automated test suite.

We recommend several months of experience with programming in PHP or a similar programming language. Participants should be familiar with the basic concepts of object-oriented programming and with automated testing using PHPUnit.

• You recognise vulnerabilities because you have traced the attack vector yourself
• You translate security requirements into automated tests instead of relying on one-off audits
• Every fixed flaw stays closed for good, protected by a green test