The idea
Do not scan. Test.
Security scanners deliver lists. This training delivers a habit: you treat every security requirement like every other functional requirement, as an executable test. The “flag” here is not proof of a break-in, but a green test that keeps the same vulnerability from coming back.
You work in a deliberately vulnerable, realistic PHP application. The vulnerabilities look like real development mistakes: forgotten escaping, string concatenation in SQL, a missing authorisation check. No framework hides them. The stations cover all ten categories of the OWASP Top 10 2025, plus logic errors that no scanner finds: a price that comes from the form, a voucher that counts twice.
The cycle
Three steps per vulnerability
Every vulnerability becomes a “station”. At each station you go through the same three-step cycle: the pattern that stays with you in your daily work afterwards.
Capture the flag
Find and exploit the vulnerability by hand, to really understand the attack vector.
Reproduce
Express the security requirement as a PHPUnit test. Against the vulnerable code it is red.
phpunit → FAILEDFix & secure
Change the code until the test is green. It stays as regression protection.
phpunit → OKWho it is for
Experienced PHP developers
What you take away
- A reusable pattern: security requirement = test
- Confidently recognising the most common classes of vulnerability in your own code
- Finding logic errors that no scanner sees: testing business rules as security requirements
- Choosing the right test level: a unit test when the vulnerability sits in one class, or an integration test when it only arises at the application boundary
- A collection of security tests as regression protection that you can adapt directly
What you bring
- Solid PHP knowledge and experience with object-oriented code
- You have written tests with PHPUnit before
- Podman or Docker; the working environment brings PHP and Composer
- Curiosity about the attacker's perspective; prior knowledge of security is not required
Your trainer
Sebastian Bergmann
Sebastian is the creator of PHPUnit, the de facto standard for testing PHP code. Since 2001 he has been helping teams build maintainable, well-tested software as a consultant and trainer, since 2009 as a co-founder of thePHP.cc.
In this training he does not walk you through slides, but through real vulnerable code. You learn how an exploit becomes a test that stays.
Registration
Four interactive live sessions of two hours each, as a Zoom meeting. Small group, real code, your questions.
Next German-language date: