Publications

YuraScanner: Leveraging LLMs for Task-driven Web App Scanning
PDF Cite
Uncovering the Role of Support Infrastructure in Clickbait PDF Campaigns
PDF Cite
The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web
PDF Cite
The Big Brother's New Playground: Unmasking the Illusion of Privacy in Web Metaverses from a Malicious User's Perspective
PDF Cite
SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications
PDF Cite
SoK: State of the Krawlers - Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements
PDF Cite
Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks
PDF Cite
The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web
PDF Cite
It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses
PDF Cite
From Attachments to SEO: Click Here to Learn More about Clickbait PDFs!
PDF Cite
The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies
PDF Cite
Where We Stand (or Fall): An Analysis of CSRF Defenses in Web Frameworks
PDF Cite
JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals
PDF Cite
Black Widow: Blackbox Data-driven Web Scanning
PDF Cite
SentiNet: Detecting Localized Universal Attack Against Deep Learning Systems
PDF Cite
Raccoon: Automated Verification of Guarded Race Conditions in Web Applications
PDF Cite
Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms
PDF Cite
Automatic Uncovering of Hidden Behaviors from Input Validation in Mobile Apps
PDF Cite
Geo-locating Drivers: A Study of Sensitive Data Leakagein Ride-Hailing Services
PDF Cite
Fidelius: Protecting User Secrets from Compromised Browsers
PDF Cite
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning
PDF Cite
The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators
PDF Cite
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
PDF Cite
Formally Reasoning about the Cost and Efficacy of Securing the Email Infrastructure
PDF Cite
Fidelius: Protecting User Secrets from Compromised Browsers
PDF Cite
Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications
PDF Cite
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning
PDF Cite
Who Controls the Internet?: Analyzing Global Threats Using Property Graph Traversals
PDF Cite DOI
Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs
PDF Cite DOI
Uses and Abuses of Server-Side Requests
PDF Cite DOI
POSTER: Mapping the Landscape of Large-Scale Vulnerability Notifications
PDF Cite DOI
Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification
PDF Cite
On the Feasibility of Side-Channel Attacks in a Virtualized Environment
PDF Cite DOI
jAEk: Using Dynamic Analysis to Crawl and Test Modern Web Applications
PDF Cite DOI
In the Compression Hornet's Nest: A Security Study of Data Compression in Network Services
PDF Cite
Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics
PDF Cite
Attribute-based Credentials for Trust: Technical Implementation and Feasibility
PDF Cite DOI
Towards a framework for assessing the feasibility of side-channel attacks in virtualized environments
Cite
Toward Black-Box Detection of Logic Flaws in Web Applications
PDF Cite
An Authentication Flaw in Browser-based Single Sign-On Protocols: Impact and Remediations
PDF Cite DOI
A Tool for Supporting Developers in Analyzing the Security of Web-Based Security Protocols
PDF Cite DOI
The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures
PDF Cite DOI
From Model-Checking to Automated Testing of Security Protocols: Bridging the Gap
PDF Cite DOI
Security Validation of Business Processes via Model-Checking
PDF Cite DOI
From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?
PDF Cite DOI
Automatic Security Analysis of SAML-based Single Sign-On Protocols
Cite
Model-Checking Driven Security Testing of Web-Based Applications
Cite DOI