Awesome Web Security Papers

Web security related academic papers collection (just for myself).

Abusing Hidden Properties to Attack the Node.js Ecosystem

• Tags: JavaScript
• Conference: USENIX Security @ 2021

[Paper] | [Source code]

JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals

• Tags: CSRF Frontend
• Conference: USENIX Security @ 2021

[Paper] | [Source code]

Prime+Probe 1, JavaScript 0: Overcoming Browser-based Side-Channel Defenses

• Tags: Frontend Side-channel
• Conference: USENIX Security @ 2021

[Paper]

Saphire: Sandboxing PHP Applications with Tailored System Call Allowlists

• Tags: PHP Sandbox
• Conference: USENIX Security @ 2021

[Paper] | [Source code]

Everything Old is New Again: Binary Security of WebAssembly

• Tags: WebAssembly
• Conference: USENIX Security @ 2020

[Paper]

Cached and Confused: Web Cache Deception in the Wild

• Tags: Cache Deception
• Conference: USENIX Security @ 2020

[Paper]

Leaky Images: Targeted Privacy Attacks in the Web

• Tags: Side-channel XS-Leaks
• Conference: USENIX Security @ 2019

[Paper]

What Are You Searching For? A Remote Keylogging Attack on Search Engine Autocomplete

• Tags: ``
• Conference: USENIX Security @ 2019

[Paper]

NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications

• Tags: Exploit generation Symbolic
• Conference: USENIX Security @ 2018

[Paper] | [Source code]

SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web

• Tags: .NET Deserialization
• Conference: NDSS @ 2021

[Paper] | [Source code]

The Cookie Hunter: Automated Black-box Auditing for Web Authentication and Authorization Flaws

• Tags: Auth Blackbox
• Conference: NDSS @ 2020

[Paper] | [Source code]

FUSE: Finding File Upload Bugs via Penetration Testing

• Tags: PHP Upload
• Conference: NDSS @ 2020

[Paper] | [Source code]

Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild

• Tags: Frontend XSS
• Conference: NDSS @ 2019

[Paper] | [Source code]

Riding out DOMsday: Toward Detecting and Preventing DOM Cross-Site Scripting

• Tags: Frontend XSS
• Conference: NDSS @ 2018

[Paper] | [Source code]

Synode: Understanding and Automatically Preventing Injection Attacks on Node.js

• Tags: JavaScript
• Conference: NDSS @ 2018

[Paper] | [Source code]

PMForce: Systematically Analyzing postMessage Handlers at Scale

• Tags: Frontend
• Conference: ACM CCS @ 2020

[Paper] | [Source code]

MalMax: Multi-Aspect Execution for Automated Dynamic Web Server Malware Analysis

• Tags: PHP Webshell
• Conference: ACM CCS @ 2019

[Paper]

Black Widow: Blackbox Data-driven Web Scanning

• Tags: Blackbox Scanner
• Conference: IEEE S&P @ 2021

[Paper]

Revealer: Detecting and Exploiting Regular Expression Denial-of-Service Vulnerabilities

• Tags: ReDoS
• Conference: IEEE S&P @ 2021

[Paper] | [Source code]

Runtime Recovery of Web Applications under Zero-Day ReDoS Attacks

• Tags: ReDoS
• Conference: IEEE S&P @ 2021

[Paper] | [Source code]