Uncovering Bigger Truths: Deobfuscating PHP with Phoebe
Manuel Karl, Simon Koch, David Klein, and Martin Johns
Annual Computer Security Applications Conference (ACSAC), 2025
The Power to Never Be Wrong: Evasions and Anachronistic Attacks Against Web Archives
Robin Kirchner, Chris Tsoukaladelis, Martin Johns, and Nick Nikiforakis
Proc. of ACM Conference on Computer and Communications Security (CCS), 2025 (to appear) [BIB] [GitHub] [Zenodo]
In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web
Jan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns, and Giancarlo Pellegrino
Proc. of ACM Conference on Computer and Communications Security (CCS), 2025 [BIB]
Confusing Value with Enumeration: Studying the Use of CVEs in Academia
Moritz Schloegel, Daniel Klischies, Simon Koch, David Klein, Lukas Gerlach, Malte Wessels, Leon Trampert, Martin Johns, Mathy Vanhoef, Michael Schwarz, Thorsten Holz, and Jo Van Bulck
34th USENIX Security Symposium, 2025 [BIB]
>>> Distinguished Paper Award Winner <<<
HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web
Malte Wessels, Simon Koch, Jan Drescher, Louis Bettels, David Klein, and Martin Johns
34th USENIX Security Symposium, 2025 [BIB]
Extract: A PHP Foot-Gun Case Study
Jannik Hartung, Simon Koch, and Martin Johns
19th USENIX WOOT Conference on Offensive Technologies (WOOT), 2025 [BIB]
>>> Best Paper Award <<<
Comma Separated Vulnerabilities: Detecting Formula Injection in the Wild
Manuel Karl, Louis Bettels, Martin Johns, and David Klein
19th USENIX WOOT Conference on Offensive Technologies (WOOT), 2025 [BIB]
Privacy-Preserving Encoding and Scaling of Tabular Data in Horizontal Federated Learning Systems
Tim Piotrowski, Zoltán Nochta, Manuel Karl, and Martin Johns
20th International Conference on Availability, Reliability and Security (ARES), 2025
Making Web Applications GDPR Compliant: A Comparative Evaluation of GDPR-Enforcement Frameworks
Felix Kalinowski, David Klein, Martin Johns, and Veelasha Moonsamy
Privacy Enhancing Technologies Symposium (PETS), 2025 [BIB]
The Impact of Default Mobile SDK Usage on Privacy and Data Protection
Simon Koch, Manuel Karl, Robin Kirchner, Malte Wessels, Anne Paschke, and Martin Johns
Privacy Enhancing Technologies Symposium (PETS'25), 2025 [PETS] [BIB]
Wemby’s Web: Hunting for Memory Corruption in WebAssembly
Oussama Draissi, Tobias Cloosters, David Klein, Michael Rodler, Marius Musch, Martin Johns, and Lucas Davi
34th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2025 [BIB]
”Sorry for bugging you so much.“ Exploring Developers’ Behavior Towards Privacy-Compliant Implementation
Stefan Albert Horstmann, Sandy Hong, David Klein, Raphael Serafini, Martin Degeling, Martin Johns, Veelasha Moonsamy, and Alena Naiakshina
46th IEEE Symposium on Security and Privacy (S&P), 2025 [BIB]
The Importance of Being Earnest: Shedding Light on Johnny’s (False) Sense of Privacy
Wirawan Agahari , Alexandra Dirksen, Martin Johns, Mark de Reuver, Tobias Fiebig
46th IEEE Symposium on Security and Privacy (S&P), 2025
Don't Patch the Researcher, Patch the Game: A Systematic Approach for Responsible Research via Federated Ethics Boards
Alexandra Dirksen, Sebastian Giessler, Hendrik Erz, Martin Johns, Tobias Fiebig
In Proceedings of the New Security Paradigms Workshop 2024.
Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting
Robin Kirchner, Jonas Möller, Marius Musch, David Klein, Konrad Rieck, Martin Johns
Proc. of the 33rd USENIX Security Symposium, 2024, Philadelphia, PA, USA. [USENIX] [Slides] [BIB] [Artifact] [Video]
>>> Distinguished Paper Award Winner <<<
SSRF vs Developers: A Study of SSRF-Defenses in PHP Applications
Malte Wessels*, Simon Koch*, Giancarlo Pellegrino, Martin Johns
Proc. of the 33rd USENIX Security Symposium, 2024, Philadelphia, PA, USA. [USENIX] [Slides] [BIB] [Artifact] [Video]
A Black-Box Privacy Analysis of Messaging Service Providers’ Chat Message Processing
Robin Kirchner, Simon Koch, Noah Kamangar, David Klein, and Martin Johns
Proc. of the 24th Privacy Enhancing Technologies Symposium (PETS), 2024, Bristol, UK. [BIB] [Artifact]
FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Multi-level Entropy-based Thresholds
Soumaya Boussaha, Lukas Hock, Miguel Bermejo, Ruben Cuevas Rumin, Angel Cuevas Rumin, David Klein, Martin Johns, Luca Compagna, Daniele Antonioli, and Thomas Barber
Proc. of the 24th Privacy Enhancing Technologies Symposium (PETS), 2024, Bristol, UK. [BIB]
The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code
Simon Koch, David Klein, and Martin Johns
Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb), 2024. [BIB]
Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials
David Klein, Martin Johns
45th IEEE Symposium on Security and Privacy (S&P), 2024. [BIB]
General Data Protection Runtime: Enforcing Transparent GDPR Compliance for Existing Applications
David Klein, Benny Rolle, Thomas Barber, Manuel Karl, Martin Johns
ACM Conference on Computer and Communications Security (CCS), 2023 [BIB]
Poster: The Risk of Insufficient Isolation of Database Transactions in Web Applications
Simon Koch, Malte Wessels, David Klein, Martin Johns
30th ACM Conference on Computer and Communications Security (CCS), 2023 [BIB]
Network Responses to Russia’s Invasion of Ukraine in 2022: A Cautionary Tale for Internet Freedom
Reethika Ramesh, Ram Sundara Raman, Apurva Virkud, Alexandra Dirksen, Armin Huremagic, David Fifield Dirk Rodenburg, Rod Hynes, Doug Madory, Roya Ensafi
USENIX Security Symposium, 2023
>>> Best Practical Paper Award Winner (FOCI'24) <<<
The OK is Not Enough: Large Scale Study of Consent Dialogs in Smartphone Applications
Simon Koch, Benjamin Altpeter, Martin Johns
USENIX Security Symposium, 2023
FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities
Samuel Groß, Simon Koch, Lukas Bernhard, Thorsten Holz, Martin Johns
Network and Distributed System Security (NDSS) Symposium, 2023
Accept All Exploits: Exploring the Security Impact of Cookie Banners
David Klein*, Marius Musch*, Thomas Barber, Moritz Kopmann, and Martin Johns
Proc. of the 37th Annual Computer Security Applications Conference (ACSAC), 2022 [BIB]
No Keys to the Kingdom Required: A Comprehensive Investigation of Missing Authentication Vulnerabilities in the Wild
Manuel Karl*, Marius Musch*, Guoli Ma, Martin Johns, and Sebastian Lekies
Proc. of the 22nd ACM Internet Measurement Conference (IMC), 2022
Keeping Privacy Labels Honest: Developer conformity to self declared data collection via Apple Privacy Labels
Simon Koch, Malte Wessels, Benjamin Altpeter, Madita Olvermann, and Martin Johns
Proc. of the 22nd Privacy Enhancing Technologies Symposium (PETS), 2022
Hand Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer Functions
David Klein, Thomas Barber, Souphiane Bensalim, Ben Stock, and Martin Johns
Proc. of the IEEE European Symposium on Security and Privacy (Euro S&P 2022), 2022 [BIB]
Server-Side Browsers: Exploring the Web’s Hidden Attack Surface
Marius Musch, Robin Kirchner, Max Boll, and Martin Johns
Proc. of the 17th ACM Asia Conference on Computer and Communications Security (ASIA CCS), 2022 [BIB]
U Can’t Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild
Marius Musch and Martin Johns
Proc. of the 30th USENIX Security Symposium, 2021
LogPicker: Strengthening Certificate Transparency Against Covert Adversaries
Alexandra Dirksen, David Klein, Robert Michael, Tilman Stehr, Konrad Rieck and Martin Johns.
Proceedings on Privacy Enhancing Technologies (PETS'21) [BIB]
Talking About My Generation: Targeted DOM-based XSS Exploit Generation using Dynamic Data Flow Analysis
Souphiane Bensalim, David Klein, Thomas Barber, Martin Johns
Proceedings of the 14th European Workshop on Systems Security (EuroSec '21) [BIB]
Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI
Marius Steffens, Marius Musch, Martin Johns, and Ben Stock
Network and Distributed System Security Symposium (NDSS), 2021
Towards Enabling Secure Web-based Cloud Services using Client-side Encryption
Martin Johns, Alexandra Dirksen
Proceedings of ACM Workshop on Cloud Computing Security (CCSW’20) [BIB]
Adversarial Preprocessing: Understanding and Preventing Image-Scaling Attacks in Machine Learning
Erwin Quiring, David Klein, Daniel Arp, Martin Johns and Konrad Rieck
Proc. of the 29th USENIX Security Symposium, August 2020 [BIB]
Raccoon: Automated Verification of Guarded Race Conditions in Web Applications
Simon Koch, Tim Sauer, Martin Johns, Giancarlo Pellegrino
Proc. of the 35th ACM/SIGAPP Symposium on Applied Computing (SAC), 2020
Hybrid Taint Analysis for Java EE
Florian D. Loch, Martin Johns, Martin Hecker, Martin Mohr, Gregor Snelting
Proc. of the 35th ACM/SIGAPP Symposium on Applied Computing (SAC), 2020
Thieves in the Browser: Web-based Cryptojacking in the Wild *Best Paper Award Runner-up*
Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck
Proc. of 14th Int. Conference on Availability, Reliability and Security (ARES), 2019
ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices
Marius Musch, Marius Steffens, Sebastian Roth, Ben Stock, and Martin Johns
Proc. of 14th ACM Asia Conference on Computer and Communications Security (ASIACCS), 2019
New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild *Best Paper Award Runner-up*
Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck
Proc. of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), 2019
Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild
Marius Steffens, Christian Rossow, Martin Johns, Ben Stock
Proc. of 26th Network and Distributed System Security Symposium (NDSS'19), February 2019
Towards an Automatic Generation of Low-Interaction Web Application Honeypots
Marius Musch, Martin Härterich, and Martin Johns
Proc. of 13th Int. Conference on Availability, Reliability and Security (ARES), 2018.
Web-based Cryptojacking in the Wild
Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck
Technical report, arXiv:1808.09474, 2018.