A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
You wrote secure code. Input is validated. No shell calls. Great. Now assume you missed something. Assume a junior developer adds a feature six months from now and reintroduces a system() call. Your server configuration is the last line of defense between a command injection and a full network compromise.
The web server process should run as www-data, nginx, or apache. Never as root. If an attacker achieves command injection, they inherit the privileges of the web server user. A www-data shell cannot read /etc/shadow, cannot install packages, and cannot modify system binaries. The blast radius is contained.
In PHP, the disable_functions directive in php.ini prevents specific functions from being called, even if the code references them. If your application never needs system, exec, passthru, or shell_exec, disable them globally.
; php.inidisable_functions = system,exec,passthru,shell_exec,popen,proc_open
Now even if a developer writes system($_GET['cmd']), PHP refuses to execute it. The function call throws a fatal error. The injection dies at the language runtime level.
; php.iniopen_basedir = /var/www/html
This confines all file operations to the web root. Even if an attacker reads files through an injection, they cannot traverse to /etc/passwd or /var/log. The scope is locked to the application directory.
A WAF is not a fix. It is a detection and delay mechanism. Use mod_security on Apache, or an external WAF like Cloudflare or AWS WAF. Configure rules to flag shell metacharacters in parameters that should only contain IPs or filenames. Reject double-encoded requests. Block non-ASCII characters in URL parameters.
A WAF buys you time. It catches the lazy attackers and the automated scanners. It will not stop a determined pentester with Bashfuscator and the techniques from this course. Treat it as one layer in a defense-in-depth strategy, never as the only layer.
Defense is layered. Code-level fixes eliminate the vulnerability. Server hardening contains the damage. WAFs add friction. Penetration testing validates everything. You have seen both sides now. The final lesson puts it all together in a realistic capstone scenario.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.