| Security testing: A survey M Felderer, M Büchler, M Johns, AD Brucker, R Breu, A Pretschner Advances in Computers 101, 1-51, 2016 | 300 | 2016 |
| 25 million flows later: large-scale detection of DOM-based XSS S Lekies, B Stock, M Johns Proceedings of the 2013 ACM SIGSAC conference on Computer & communications …, 2013 | 278 | 2013 |
| Xssds: Server-side detection of cross-site scripting attacks M Johns, B Engelmann, J Posegga 2008 Annual Computer Security Applications Conference (ACSAC), 335-344, 2008 | 181 | 2008 |
| Plug-in privacy for smart metering billing M Jawurek, M Johns, F Kerschbaum International Symposium on Privacy Enhancing Technologies Symposium, 192-210, 2011 | 180 | 2011 |
| RequestRodeo: Client side protection against session riding M Johns, J Winter Proceedings of the OWASP Europe 2006 Conference, 2006 | 167 | 2006 |
| Precise client-side protection against {DOM-based}{Cross-Site} scripting B Stock, S Lekies, T Mueller, P Spiegel, M Johns 23rd USENIX Security Symposium (USENIX Security 14), 655-670, 2014 | 159 | 2014 |
| Hey, you have a problem: On the feasibility of {Large-Scale} web vulnerability notification B Stock, G Pellegrino, C Rossow, M Johns, M Backes 25th USENIX Security Symposium (USENIX Security 16), 1015-1032, 2016 | 153 | 2016 |
| SessionShield: Lightweight protection against session hijacking N Nikiforakis, W Meert, Y Younan, M Johns, W Joosen International Symposium on Engineering Secure Software and Systems, 87-100, 2011 | 145 | 2011 |
| Smart metering de-pseudonymization M Jawurek, M Johns, K Rieck Proceedings of the 27th annual computer security applications conference …, 2011 | 141 | 2011 |
| Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild. M Steffens, C Rossow, M Johns, B Stock CISPA, 2019 | 111 | 2019 |
| How the Web Tangled Itself: Uncovering the History of {Client-Side} Web ({In) Security} B Stock, M Johns, M Steffens, M Backes 26th USENIX Security Symposium (USENIX Security 17), 971-987, 2017 | 102 | 2017 |
| Deemon: Detecting CSRF with dynamic analysis and property graphs G Pellegrino, M Johns, S Koch, M Backes, C Rossow Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications …, 2017 | 100 | 2017 |
| Adversarial preprocessing: Understanding and preventing {Image-Scaling} attacks in machine learning E Quiring, D Klein, D Arp, M Johns, K Rieck 29th USENIX Security Symposium (USENIX Security 20), 1363-1380, 2020 | 99 | 2020 |
| Thieves in the browser: Web-based cryptojacking in the wild M Musch, C Wressnegger, M Johns, K Rieck Proceedings of the 14th International Conference on Availability …, 2019 | 99* | 2019 |
| New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild M Musch, C Wressnegger, M Johns, K Rieck International Conference on Detection of Intrusions and Malware, and …, 2019 | 96 | 2019 |
| Code-reuse attacks for the web: Breaking cross-site scripting mitigations via script gadgets S Lekies, K Kotowicz, S Groß, EA Vela Nava, M Johns Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications …, 2017 | 84 | 2017 |
| FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities. S Groß, S Koch, L Bernhard, T Holz, M Johns NDSS, 2023 | 76 | 2023 |
| The Unexpected Dangers of Dynamic {JavaScript} S Lekies, B Stock, M Wentzel, M Johns 24th USENIX Security Symposium (USENIX Security 15), 723-735, 2015 | 76 | 2015 |
| On JavaScript Malware and related threats: Web page based attacks revisited M Johns Journal in Computer Virology 4 (3), 161-178, 2008 | 76 | 2008 |
| SessionSafe: Implementing XSS immune session handling M Johns European symposium on research in computer security, 444-460, 2006 | 75 | 2006 |
Ben StockCISPA Helmholtz Center for Information SecurityVerified email at cispa.de
