Source Code Review: PHP

Secure code review is the practice of reading an application's source code to find security flaws, understand why they exist, and judge how they can be reached and abused. Because we work with full visibility of the code rather than guessing at its behaviour from the outside, it is a white-box activity.

This stands in contrast to black-box testing, where we have no source and can only infer what the application does from the responses it returns. A black-box tester who watches a login form reject a payload has to guess what happened on the server. When we hold the source, however, we can see the exact comparison the password runs through, the query the username is placed into, and every branch the input can take. As a result, a review tends to find deeper and more certain issues for the time we invest, because the flaw and its root cause sit in the same place in front of us.

Almost every web vulnerability is the same story told with different functions. Untrusted data enters the application at one point and reaches another point that trusts it, with nothing in between that genuinely makes it safe. When we follow that data from where it arrives to where it is dangerously used, we are performing what is called taint analysis, and it is the foundation of secure code review.

Our approach is methodical rather than a fixed set of payloads, and the same process applies whether we are on a paid engagement with a code drop, hunting bugs in an open-source project, or reviewing our own code before it ships.

The skill pays off widely, because a large share of the web still runs on PHP. Small bespoke scripts run on it. Large platforms such as WordPress, Drupal and Magento run on it. So do modern framework applications built on Laravel and Symfony. The functions and conventions differ in each case, but the discipline of tracing untrusted data to a dangerous use stays the same.

Learning Objectives

By the end of this room, you will be able to:

• Describe what secure code review is, how white-box differs from black-box testing, and when each is appropriate
• Approach an unfamiliar PHP codebase systematically by identifying its framework and dependencies, reading its configuration, and mapping its attack surface
• Enumerate PHP sources and sinks and group those sinks by the vulnerability class they produce
• Trace data flow from source to sink and judge whether any sanitisation in between actually neutralises the input
• Recognise PHP-specific pitfalls on sight, such as loose comparison, weak randomness, dangerous variable-handling functions, and the stream wrappers
• Identify and confirm injection, cross-site scripting, file-inclusion, path-traversal, upload, deserialisation, SSRF, and XXE flaws from the source
• Apply a framework-aware review to Laravel and Symfony
• Use static-analysis tooling as a lead generator, triage its output, and write a finding up clearly

Prerequisites

This room assumes you can read PHP, although you do not need to be able to write it, and that you are comfortable on the Linux command line with tools such as grep and confirming a finding withcurl. Before starting, it is worth completing the following rooms and modules:

• OWASP Top 10 - 2025 
• SQL Injection 
• Insecure Deserialisation
• Linux Fundamentals

Machine Access

Start the machine attached to this room now by pressing the green Start Machine button below.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine