Secure Python Development with OWASP Training Course

Who should attend

The secure Python development with OWASP training course is suitable for application developers, testers, and anyone else involved in the production of Python code and includes coverage of front- and back-end systems security techniques.

Prerequisites

Delegates should have experience of writing or testing Python code.

Live, instructor-led online and on-site training

We appreciate that you need flexibility to fit in with new working situations - whether you're an individual, part of a distributed team, or simply have projects and deadlines to meet. 

Our remote training can take place online in a virtual classroom, with content split into modules to accommodate your scheduling challenges and meet your learning goals. Get in touch today to find out how we can help design a cost-effective, flexible training solution.

Day 1: Introduction to Security Vulnerabilities in Flask Applications

Objective of Day 1:

Introduce participants to the key security vulnerabilities in Flask applications, specifically the OWASP Top 10. Participants will learn how vulnerabilities such as SQL Injection, XSS, and CSRF manifest in Flask apps and how to mitigate them.

Sessions and Labs:

1. Session 1: Introduction to Flask Security and OWASP Top 10

• Overview of Flask web development
• Introduction to the OWASP Top 10 and its relevance to Flask
• Discuss key Flask security challenges (SQLi, XSS, CSRF)

2. Session 2: SQL Injection in Flask

• What is SQL Injection?
• How SQL Injection works in Flask applications
• Best practices for mitigating SQL Injection

- Lab 1: Detecting and Fixing SQL Injection

• Participants will explore a vulnerable Flask app and perform SQL Injection.
• Implement fixes using parameterised queries with SQLite.

3. Session 3: Cross-Site Scripting (XSS) in Flask

• Explanation of XSS and its impact on Flask apps
• How Flask apps are vulnerable to XSS
• Preventing XSS using input sanitisation and output encoding

- Lab 2: Detecting and Fixing XSS Vulnerabilities

• Demonstrate XSS vulnerability in a Flask route.
• Implement a fix using `escape()` and Flask extensions like `Flask-WTF`.

4. Session 4: Cross-Site Request Forgery (CSRF) in Flask

• Understanding CSRF and its risks
• How to prevent CSRF attacks in Flask

- Lab 3: Fixing CSRF Vulnerabilities

• Work through a vulnerable Flask form.
• Implement CSRF protection using `Flask-WTF`

Day 2: Advanced Flask Security Topics

Objective of Day 2:

Explore more advanced security issues, including insecure file uploads, server-side template injection (SSTI), and command injection. Learn how to secure these elements within Flask applications.

Sessions and Labs:

1. Session 1: Insecure File Uploads in Flask

• Common risks associated with file uploads
• How to safely handle file uploads in Flask

- Lab 4: Securing File Uploads

• Implement file upload validation (e.g., file extension checks) and secure storage.

2. Session 2: Server-Side Template Injection (SSTI) in Flask

• Explanation of SSTI and its impact on Flask applications
• How user input can exploit template engines

- Lab 5: Preventing SSTI

• Demonstrate SSTI vulnerability.
• Use Flask's `escape()` function to secure templates.

3. Session 3: Command Injection in Flask

• Risks of passing untrusted data to system commands
• Using safe subprocess handling methods to mitigate command injection

- Lab 6: Detecting and Fixing Command Injection

• Explore a vulnerable command injection in a Flask route.
• Implement a secure subprocess call with arguments.

4. Session 4: Secure Authentication and Session Management

• Overview of secure user authentication mechanisms
• Using secure session management (cookies, token-based authentication)

- Lab 7: Securing Authentication and Sessions

• Implement secure login and session management using `Flask-Login` or `Flask-Security`.

Day 3: Secure Development Practices and Best Practices for Flask

Objective of Day 3:

Consolidate security knowledge by applying best practices to Flask development. This day will also cover penetration testing, secure logging, and how to integrate security throughout the development lifecycle.

---

Sessions and Labs:

1. Session 1: Secure Development Lifecycle (SDLC) in Flask

• The importance of security throughout the development lifecycle
• Integrating security practices into your workflow (e.g., code reviews, CI/CD)

- Lab 8: Secure Flask App Review

• Participants will review a Flask application and identify areas for security improvement.

2. Session 2: Insecure Deserialization and Secure Data Handling

• Introduction to the risks of insecure deserialization
• Safely handling data (serialization formats like JSON vs. pickle)

- Lab 9: Preventing Insecure Deserialization

• Detect insecure deserialization vulnerabilities and replace `pickle` with safer alternatives.

3. Session 3: Logging Security Best Practices

• The risks of improper logging (log injection, information leaks)
• Best practices for logging securely in Flask

- Lab 10: Secure Logging Implementation

• Implement secure logging with sanitized user inputs, preventing log injection.

4. Session 4: Penetration Testing and Security Scanning

• Introduction to security testing tool
• Conducting security scans to identify vulnerabilities in Flask applications

- Lab 11: Penetration Testing

• Participants will scan a vulnerable Flask app and identify potential vulnerabilities.

5. Wrap-up Session: Final Security Review and Q&A

• Review the key concepts learned throughout the course
• Address any remaining questions
• Discuss integrating security into the Flask development process