Ben Stock

Publications
Influence

25 million flows later: large-scale detection of DOM-based XSS

Sebastian Lekies, Ben Stock, M. Johns
Computer Science
CCS
4 November 2013

We present a fully automated system to detect and validate DOM-based XSS vulnerabilities, consisting of a taint-aware JavaScript engine and corresponding DOM implementation as well as a context-sensitive exploit generation approach. Expand

Walowdac - Analysis of a Peer-to-Peer Botnet

Ben Stock, J. Göbel, Markus Engelberth, F. Freiling, T. Holz
Computer Science
European Conference on Computer Network Defense
9 November 2009

We present our in ltration of the Waledac botnet, which can be seen as the successor of the Storm Worm botnet. Expand

Precise Client-side Protection against DOM-based Cross-Site Scripting

Ben Stock, Sebastian Lekies, T. Mueller, Patrick Spiegel, M. Johns
Computer Science
USENIX Security Symposium
20 August 2014

We propose an alternative approach for client-side prevention of DOM-based XSS, that utilizes runtime taint tracking and taint-aware parsers to stop the parsing of attacker-controlled syntactic content. Expand

HideNoSeek: Camouflaging Malicious JavaScript in Benign ASTs

A. Fass, M. Backes, Ben Stock
Computer Science
CCS
6 November 2019

We introduce a novel and generic camouflage attack, which evades the entire class of detectors based on syntactic features, without needing any information about the system it is trying to evade. Expand

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications

Ben Stock, G. Pellegrino, F. Li, M. Backes, C. Rossow
Computer Science
NDSS
1 February 2018

We report on a notification experiment targeting 24,000 domains, which allowed us to analyze what technical and human aspects are roadblocks to a successful campaign. Expand

The Unexpected Dangers of Dynamic JavaScript

Sebastian Lekies, Ben Stock, M. Wentzel, M. Johns
Computer Science
USENIX Security Symposium
12 August 2015

We present the first, systematic analysis of this vulnerability class and provide empirical evidence on its seveess. Expand

Protecting users against XSS-based password manager abuse

Ben Stock, M. Johns
Computer Science
AsiaCCS
4 June 2014

In this paper, we have demonstrated that current implementations of built-in password managers in browsers are vulnerable to XSS attacks targeting the stored passwords. Expand

Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification

Ben Stock, G. Pellegrino, C. Rossow, M. Johns, M. Backes
Computer Science
USENIX Security Symposium
10 August 2016

Large-scale discovery of thousands of vulnerable Web sites has become a frequent event, thanks to the rise in maturity of Internet-wide scanning tools. Expand

From Facepalm to Brain Bender: Exploring Client-Side Cross-Site Scripting

Ben Stock, Stephan Pfistner, Bernd Kaiser, Sebastian Lekies, M. Johns
Computer Science
CCS
12 October 2015

We analyze a set of 1,273 real-world vulnerabilities contained on the Alexa Top 10k domains using a specifically designed architecture, consisting of an infrastructure which allows us to persist and replay vulnerabilities to ensure a sound analysis. Expand

Efficient and Flexible Discovery of PHP Application Vulnerabilities

M. Backes, K. Rieck, M. Skoruppa, Ben Stock, Fabian Yamaguchi
Computer Science
IEEE European Symposium on Security and Privacy…
26 April 2017

We present an interprocedural analysis technique for PHP applications based on code property graphs that scales well to large amounts of code and is highly adaptable in its nature. Expand

Recommended Authors