Projects

CHARON

CHARON is a polyglot static analysis engine for detecting vulnerabilities in scripting languages native extensions.

YuraScanner

One of the first task-driven, autonomous LLM-powered web application scanner

SURFER

A static analysis tool to find SSRF candidates in PHP CPGs.

Arachnarium

Arachnarium is a plug-and-play benchmark framework for crawlers that can run experiments at scale against both local, standalone web applications and live websites.

JAW (Javascript Analysis frameWork)

JAW is a scalable framework to analyze client-side JavaScript programs. JAW can be used to conduct interactive and exploratory analysis of JavaScript code.

Black Widow

Black widow is a new data-driven web application scanner that combines three techniques: navigation modeling, graph traversing, and tracking inter-state dependencies.

Ad-Versarial

We released scripts, datasets, and trained YOLOv3 models of our work Ad-versarial: Defeating Perceptual Ad-Blocking.

Fidelius

Fidelius is a new architecture with trusted path for user I/O/ and Web Enclaves, to protect user secrets even if the entire underlying browser and OS are fully controlled by a malicious attacker.

Deemon

Deemon detects CSRF in PHP/SQL web applications by combining dynamic analysis with property graphs.

Guenther

Guenther tests web applications against Server Side Request (SSR) abuse including Web Origin Laundering, Server Side Request Forgery (SSRF) and other abuses.