Publications

Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications
Cite
YuraScanner: Leveraging LLMs for Task-driven Web App Scanning
PDF Cite
Permission Rationales in the Web Ecosystem: An Exploration of Rationale Text and Design Patterns
PDF Cite
Less is More: Boosting Coverage of Web Crawling through Adversarial Multi-Armed Bandit
PDF Cite
In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web
PDF Cite
Exploring the Design Space for Security Warnings in Immersive Environments
PDF Cite
Exploration of the Dynamics of Buy and Sale of Social Media Accounts
PDF Cite
Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection
PDF Cite
CHARON: Polyglot Code Analysis for Detecting Vulnerabilities in Scripting Languages Native Extensions
PDF Cite
Uncovering the Role of Support Infrastructure in Clickbait PDF Campaigns
PDF Cite
The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web
PDF Cite
The Big Brother's New Playground: Unmasking the Illusion of Privacy in Web Metaverses from a Malicious User's Perspective
PDF Cite
SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications
PDF Cite
SoK: State of the Krawlers - Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements
PDF Cite
Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks
PDF Cite
Exploration of the Dynamics of Buy and Sale of Social Media Accounts
Cite
The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web
PDF Cite
It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses
PDF Cite
From Attachments to SEO: Click Here to Learn More about Clickbait PDFs!
PDF Cite
The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies
PDF Cite
Where We Stand (or Fall): An Analysis of CSRF Defenses in Web Frameworks
PDF Cite
JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals
PDF Cite
Black Widow: Blackbox Data-driven Web Scanning
PDF Cite
SentiNet: Detecting Localized Universal Attack Against Deep Learning Systems
PDF Cite
Raccoon: Automated Verification of Guarded Race Conditions in Web Applications
PDF Cite
Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms
PDF Cite
Automatic Uncovering of Hidden Behaviors from Input Validation in Mobile Apps
PDF Cite
Geo-locating Drivers: A Study of Sensitive Data Leakagein Ride-Hailing Services
PDF Cite
Fidelius: Protecting User Secrets from Compromised Browsers
PDF Cite
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning
PDF Cite
The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators
PDF Cite
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
PDF Cite
Formally Reasoning about the Cost and Efficacy of Securing the Email Infrastructure
PDF Cite
Fidelius: Protecting User Secrets from Compromised Browsers
PDF Cite
Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications
PDF Cite
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning
PDF Cite
Who Controls the Internet?: Analyzing Global Threats Using Property Graph Traversals
PDF Cite DOI
Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs
PDF Cite DOI
Uses and Abuses of Server-Side Requests
PDF Cite DOI
POSTER: Mapping the Landscape of Large-Scale Vulnerability Notifications
PDF Cite DOI
Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification
PDF Cite
On the Feasibility of Side-Channel Attacks in a Virtualized Environment
PDF Cite DOI
jAEk: Using Dynamic Analysis to Crawl and Test Modern Web Applications
PDF Cite DOI
In the Compression Hornet's Nest: A Security Study of Data Compression in Network Services
PDF Cite
Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics
PDF Cite
Attribute-based Credentials for Trust: Technical Implementation and Feasibility
PDF Cite DOI
Towards a framework for assessing the feasibility of side-channel attacks in virtualized environments
Cite
Toward Black-Box Detection of Logic Flaws in Web Applications
PDF Cite
An Authentication Flaw in Browser-based Single Sign-On Protocols: Impact and Remediations
PDF Cite DOI
A Tool for Supporting Developers in Analyzing the Security of Web-Based Security Protocols
PDF Cite DOI
The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures
PDF Cite DOI
From Model-Checking to Automated Testing of Security Protocols: Bridging the Gap
PDF Cite DOI
Security Validation of Business Processes via Model-Checking
PDF Cite DOI
From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?
PDF Cite DOI
Automatic Security Analysis of SAML-based Single Sign-On Protocols
Cite
Model-Checking Driven Security Testing of Web-Based Applications
Cite DOI