Martin Johns
where else to find them
what they talk about
all 5 in the filters
where they keep going back
no series more than once — all 11 in the filters
on a stage with
all 21 in the filters
who talks about the same things
- Ben Stock16 talks
- Sebastian Lekies8 talks
- Frederik Braun3 talks
- Benedek Gagyi8 talks
- Gareth Heyes5 talks
- Anand Vemuri2 talks
| title | conference | date |
|---|---|---|
| Confusing Value with Enumeration: Studying the Use of CVEs in Academia | USENIX Security '25 | 2025-08-13 |
Analysis of 1,803 CVEs claimed in 304 papers finds 34% unconfirmed or disputed, 274 reserved, 288 with no maintainer response, and 52 where maintainers say… | ||
| Comma Separated Vulnerabilities: Detecting Formula Injection in the Wild | 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25) | 2025-08-11 |
Claims that CSV files enable remote data exfiltration and even code execution by embedding spreadsheet formulas, and backs it with a tool and measurements… | ||
| Extract: A PHP Foot-Gun Case Study | 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25) | 2025-08-11 |
Claims that extract routinely enables attackers to overwrite important variables, backed by a static-analysis pass over a code property graph and manual review… | ||
| ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices | OWASP Global AppSec Amsterdam 2019 | 2019-09-23 |
Claims a concrete mitigation: a lightweight protection suite that protects against third‑party XSS, intercepts event handlers and script APIs, and integrates… | ||
| How the Web Tangled Itself | 26th USENIX Security Symposium (USENIX Security '17) | 2017-08-16 |
Analysis of Internet Archive snapshots (1997–2016) inspects 659,710 documents, 1.4M frames, 5M scripts and 21M HTTP headers to track client-side security… | ||
| Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability | USENIX Security '16 | 2016-08-10 |
Study scans the Alexa top million and finds 44,000 vulnerable domains (WordPress and site-specific DOM XSS), splits them into five groups, and sends targeted… | ||
| Eavesdropping on WebRTC Communication with Funny Cat Pictures | RuhrSec 2016 | 2016-04-28 |
Demonstrates a practical attack that turns browser JavaScript into a man-in-the-middle: a single Cross-site Scripting bug, a compromised signaling server, or a… | ||
| Your Scripts In My Page - What Could Possibly Go Wrong? | Black Hat Europe 2015 | 2015-11-10 |
Demonstrates a practical attack called cross-domain script inclusion and a browser extension that fetches scripts with and without cookies to detect… | ||
| Client-Side Protection Against DOM-Base... | OWASP AppSec Research (AppSecEU) 2015 | 2015-05-19 |
A practical evaluation finds the built-in XSS auditor misses many DOM XSS cases: a taint-tracking crawler and automated exploit generator targets the Alexa top… | ||
| Client-Side Protection Against DOM-Based XSS Done Right (tm) | Black Hat Asia 2015 | 2015-03-24 |
Analysis finds 17 Chrome XSS Auditor flaws and a bypass toolkit that auto-generates exploits; running those probes against the Alexa Top 10k uncovers about… | ||
| Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering | Black Hat USA 2014 | 2014-08-02 |
Analysis shows Chrome's XSS Auditor has concrete weaknesses: a static code review finds 17 flaws, an automatic exploit generator (taint-tracking patched… | ||
| Finding and Preventing Buffer Overflows | 22C3: Private Investigations | 2005-12-27 |
An overview of static and dynamic approaches
A talk that will present academic tools, which are designed to find or disarm security problems in C code | ||
| nothing matches | ||