Ben Stock
where else to find them
x:kcotsneb
what they talk about
where they keep going back
- RuhrSec4 editions2019–2025
- Black Hat Europe2 editions2014–2015
all 10 in the filters
on a stage with
all 9 in the filters
who talks about the same things
- Sebastian Lekies8 talks
- Martin Johns14 talks
- Frederik Braun3 talks
- Marius Steffens3 talks
- Sebastian Roth6 talks
- Mike West7 talks
| title | conference | date |
|---|---|---|
| Double-Edged Shield: On the Fingerprintability of Customized Ad Blockers | USENIX Security '25 | 2025-08-13 |
Claim: customized ad‑blocker filter selections are fingerprintable. The authors build three scriptless fingerprinting attacks (notably a CSS animation attack… | ||
| Keynote – Complexity Kills – Why Adding Layers of Security Doesn’t Solve Much | RuhrSec 2025 | 2025-02-20 |
RuhrSec is the annual English speaking IT security conference with cutting-edge security talks by renowned experts. RuhrSec is organized by Hackmanit.
🔽 More… | ||
| You Can't Always Get What You Want – How Web Sites... | RuhrSec 2023 | 2023-05-11 |
Measured across top 10,000 sites with five fresh requests per test using varying user agents, VPN/Tor and language settings, the team finds 321 sites with… | ||
| I Wanna Deploy You, but My Senses Tell Me to ... | RuhrSec Day 2022 | 2022-05-05 |
Analysis of ~10,000 sites over 12 weeks shows CSP adoption rises but is often ineffective: 95% meaningless (unsafe-inline, data: URIs or open https wildcards)… | ||
| Restricting the scripts, you're ... | RuhrSec 2020 #StayAtHome Edition | 2020-05-08 |
A seven‑year archive study of 10,000 sites extracts Content Security Policy headers from 2012–2018 and finds only about 11% adoption by end of 2018, with level… | ||
| Restricting The Scripts, You're To Blame, You Give CSP A Bad Name | OWASP Global AppSec Amsterdam 2019 | 2019-09-23 |
A longitudinal scan of 10,000 sites (2012–2018) shows CSP adoption rising but script restriction rarely effective: only about one third of policies touch… | ||
| The Insecurity Caused By Trusting Your Client-Side Storage | OWASP Global AppSec Amsterdam 2019 | 2019-09-23 |
Client-side stores like cookies localStorage and IndexedDB lead to persistent client-side XSS when developer code later writes those values into the DOM. The… | ||
| Don't Trust The Locals: Exploiting Persistent ... | RuhrSec 2019 | 2019-05-28 |
RuhrSec is the annual English speaking non-profit IT security conference with cutting-edge security talks by renowned experts. https://www.ruhrsec.de/
Talk… | ||
| How the Web Tangled Itself | 26th USENIX Security Symposium (USENIX Security '17) | 2017-08-16 |
Analysis of Internet Archive snapshots (1997–2016) inspects 659,710 documents, 1.4M frames, 5M scripts and 21M HTTP headers to track client-side security… | ||
| Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability | USENIX Security '16 | 2016-08-10 |
Study scans the Alexa top million and finds 44,000 vulnerable domains (WordPress and site-specific DOM XSS), splits them into five groups, and sends targeted… | ||
| Your Scripts In My Page - What Could Possibly Go Wrong? | Black Hat Europe 2015 | 2015-11-10 |
Demonstrates a practical attack called cross-domain script inclusion and a browser extension that fetches scripts with and without cookies to detect… | ||
| Client-Side Protection Against DOM-Base... | OWASP AppSec Research (AppSecEU) 2015 | 2015-05-19 |
A practical evaluation finds the built-in XSS auditor misses many DOM XSS cases: a taint-tracking crawler and automated exploit generator targets the Alexa top… | ||
| Client-Side Protection Against DOM-Based XSS Done Right (tm) | Black Hat Asia 2015 | 2015-03-24 |
Analysis finds 17 Chrome XSS Auditor flaws and a bypass toolkit that auto-generates exploits; running those probes against the Alexa Top 10k uncovers about… | ||
| Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers | Black Hat Europe 2014 | 2014-10-14 |
Cross-site scripting lets JavaScript read passwords because browser managers insert plaintext into the DOM; major browsers differ — only Internet Explorer… | ||
| Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering | Black Hat USA 2014 | 2014-08-02 |
Analysis shows Chrome's XSS Auditor has concrete weaknesses: a static code review finds 17 flaws, an automatic exploit generator (taint-tracking patched… | ||
| nothing matches | ||