Model-Checking Driven Security Testing of Web-Based Applications. - Alessandro Armando; Roberto Carbone; Luca Compagna; Keqin Li 002; Giancarlo Pellegrino (ICST Workshops, 2010)

Security Validation of Business Processes via Model-Checking. - Wihem Arsac; Luca Compagna; Giancarlo Pellegrino; Serena Elisa Ponta (ESSoS, 2011)

From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure? - Alessandro Armando; Roberto Carbone; Luca Compagna; Jorge Cuéllar; Giancarlo Pellegrino; Alessandro Sorniotti (SEC, 2011)

The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures. - Alessandro Armando; Wihem Arsac; Tigran Avanesov; Michele Barletta; Alberto Calvi; Alessandro Cappai; Roberto Carbone; Yannick Chevalier; Luca Compagna; Jorge Cuéllar; Gabriel Erzse; Simone Frau; et al. (TACAS, 2012)

From Model-Checking to Automated Testing of Security Protocols: Bridging the Gap. - Alessandro Armando; Giancarlo Pellegrino; Roberto Carbone; Alessio Merlo; Davide Balzarotti (TAP@TOOLS, 2012)

A Tool for Supporting Developers in Analyzing the Security of Web-Based Security Protocols. - Giancarlo Pellegrino; Luca Compagna; Thomas Morreggia (ICTSS, 2013)

An authentication flaw in browser-based Single Sign-On protocols: Impact and remediations. - Alessandro Armando; Roberto Carbone; Luca Compagna; Jorge Cuéllar; Giancarlo Pellegrino; Alessandro Sorniotti (Comput. Secur., 2013)

Detection of logic flaws in multi-party business applications via security testing. (Détection d'anomalies logiques dans les logiciels d'entreprise multi-partis à travers des tests de sécurité). - Giancarlo Pellegrino (2013)

On the Feasibility of Side-Channel Attacks in a Virtualized Environment. - Tsvetoslava Vateva-Gurova; Jesus Luna; Giancarlo Pellegrino; Neeraj Suri (ICETE (Selected Papers), 2014)

Toward Black-Box Detection of Logic Flaws in Web Applications. - Giancarlo Pellegrino; Davide Balzarotti (NDSS, 2014)

Towards a Framework for Assessing the Feasibility of Side-channel Attacks in Virtualized Environments. - Tsvetoslava Vateva-Gurova; Jesus Luna; Giancarlo Pellegrino; Neeraj Suri (SECRYPT, 2014)

Technical Implementation and Feasibility. - Gert Læssøe Mikkelsen; Kasper Damgård; Hans Guldager; Jonas Lindstrøm Jensen; Jesus Luna Garcia; Janus Dam Nielsen; Pascal Paillier; Giancarlo Pellegrino; Michael Bladt Stausholm; Neeraj Suri; Heng Zhang 009 (Attribute-based Credentials for Trust, 2015)

jÄk: Using Dynamic Analysis to Crawl and Test Modern Web Applications. - Giancarlo Pellegrino; Constantin Tschürtz; Eric Bodden; Christian Rossow (RAID, 2015)

In the Compression Hornet's Nest: A Security Study of Data Compression in Network Services. - Giancarlo Pellegrino; Davide Balzarotti; Stefan Winter 001; Neeraj Suri (USENIX Security Symposium, 2015)

Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics. - Giancarlo Pellegrino; Christian Rossow; Fabrice J. Ryba; Thomas C. Schmidt; Matthias Wählisch (WOOT, 2015)

POSTER: Mapping the Landscape of Large-Scale Vulnerability Notifications. - Ben Stock; Giancarlo Pellegrino; Christian Rossow; Martin Johns; Michael Backes 001 (CCS, 2016)

Uses and Abuses of Server-Side Requests. - Giancarlo Pellegrino; Onur Catakoglu; Davide Balzarotti; Christian Rossow (RAID, 2016)

Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification. - Ben Stock; Giancarlo Pellegrino; Christian Rossow; Martin Johns; Michael Backes 001 (USENIX Security Symposium, 2016)

Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs. - Giancarlo Pellegrino; Martin Johns; Simon Koch 001; Michael Backes 001; Christian Rossow (CCS, 2017)

Who Controls the Internet?: Analyzing Global Threats using Property Graph Traversals. - Milivoj Simeonovski; Giancarlo Pellegrino; Christian Rossow; Michael Backes 001 (WWW, 2017)

Formally Reasoning about the Cost and Efficacy of Securing the Email Infrastructure. - Patrick Speicher; Marcel Steinmetz; Robert Künnemann; Milivoj Simeonovski; Giancarlo Pellegrino; Jörg Hoffmann 001; Michael Backes 001 (EuroS&P, 2018)

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications. - Ben Stock; Giancarlo Pellegrino; Frank Li 001; Michael Backes 001; Christian Rossow (NDSS, 2018)

The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators. - Marten Oltrogge; Erik Derr; Christian Stransky; Yasemin Acar; Sascha Fahl; Christian Rossow; Giancarlo Pellegrino; Sven Bugiel; Michael Backes 001 (IEEE Symposium on Security and Privacy, 2018)

Ad-versarial: Defeating Perceptual Ad-Blocking. - Florian Tramèr; Pascal Dupré; Gili Rusak; Giancarlo Pellegrino; Dan Boneh (CoRR, 2018)

SentiNet: Detecting Physical Attacks Against Deep Learning Systems. - Edward Chou; Florian Tramèr; Giancarlo Pellegrino; Dan Boneh (CoRR, 2018)

AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning. - Florian Tramèr; Pascal Dupré; Gili Rusak; Giancarlo Pellegrino; Dan Boneh (CCS, 2019)

Geo-locating Drivers: A Study of Sensitive Data Leakage in Ride-Hailing Services. - Qingchuan Zhao; Chaoshun Zuo; Giancarlo Pellegrino; Zhiqiang Lin 001 (NDSS, 2019)

Fidelius: Protecting User Secrets from Compromised Browsers. - Saba Eskandarian; Jonathan Cogan; Sawyer Birnbaum; Peh Chang Wei Brandon; Dillon Franke; Forest Fraser; Gaspar Garcia Jr.; Eric Gong; Hung T. Nguyen; Taresh K. Sethi; Vishal Subbiah; Michael Backes 001; et al. (IEEE Symposium on Security and Privacy, 2019)

Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms. - Giada Stivala; Giancarlo Pellegrino (NDSS, 2020)

Raccoon: automated verification of guarded race conditions in web applications. - Simon Koch 001; Tim Sauer; Martin Johns; Giancarlo Pellegrino (SAC, 2020)

SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems. - Edward Chou; Florian Tramèr; Giancarlo Pellegrino (SP (Workshops), 2020)

Automatic Uncovering of Hidden Behaviors From Input Validation in Mobile Apps. - Qingchuan Zhao; Chaoshun Zuo; Brendan Dolan-Gavitt; Giancarlo Pellegrino; Zhiqiang Lin 001 (SP, 2020)

Where We Stand (or Fall): An Analysis of CSRF Defenses in Web Frameworks. - Xhelal Likaj; Soheil Khodayari; Giancarlo Pellegrino (RAID, 2021)

Black Widow: Blackbox Data-driven Web Scanning. - Benjamin Eriksson; Giancarlo Pellegrino; Andrei Sabelfeld (SP, 2021)

JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals. - Soheil Khodayari; Giancarlo Pellegrino (USENIX Security Symposium, 2021)

The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies. - Soheil Khodayari; Giancarlo Pellegrino (SP, 2022)

From Attachments to SEO: Click Here to Learn More about Clickbait PDFs! - Giada Stivala; Sahar Abdelnabi; Andrea Mengascini; Mariano Graziano; Mario Fritz; Giancarlo Pellegrino (ACSAC, 2023)

It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses. - Soheil Khodayari; Giancarlo Pellegrino (SP, 2023)

The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web. - Jannis Rautenstrauch; Giancarlo Pellegrino; Ben Stock (SP, 2023)

A Large-Scale Study of Phishing PDF Documents. - Giada Stivala; Sahar Abdelnabi; Andrea Mengascini; Mariano Graziano; Mario Fritz; Giancarlo Pellegrino (CoRR, 2023)

The Big Brother's New Playground: Unmasking the Illusion of Privacy in Web Metaverses from a Malicious User's Perspective. - Andrea Mengascini; Ryan Aurelio; Giancarlo Pellegrino (CCS, 2024)

Uncovering the Role of Support Infrastructure in Clickbait PDF Campaigns. - Giada Stivala; Gianluca De Stefano; Andrea Mengascini; Mariano Graziano; Giancarlo Pellegrino (EuroS&P, 2024)

The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web. - Soheil Khodayari; Thomas Barber; Giancarlo Pellegrino (SP, 2024)

SoK: State of the Krawlers - Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements. - Aleksei Stafeev; Giancarlo Pellegrino (USENIX Security Symposium, 2024)

SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications. - Malte Wessels; Simon Koch 001; Giancarlo Pellegrino; Martin Johns (USENIX Security Symposium, 2024)

Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks. - Gianluca De Stefano; Lea Schönherr; Giancarlo Pellegrino (CoRR, 2024)

Exploration of the Dynamics of Buy and Sale of Social Media Accounts. - Mario Beluri; Bhupendra Acharya; Soheil Khodayari; Giada Stivala; Giancarlo Pellegrino; Thorsten Holz (CoRR, 2024)

Permission Rationales in the Web Ecosystem: An Exploration of Rationale Text and Design Patterns. - Yusra Elbitar; Soheil Khodayari; Marian Harbach; Gianluca De Stefano; Balazs Csaba Engedy; Giancarlo Pellegrino; Sven Bugiel (CHI, 2025)

Less is More: Boosting Coverage of Web Crawling through Adversarial Multi-Armed Bandit. - Lorenzo Cazzaro; Stefano Calzavara; Maksim Kovalkov; Aleksei Stafeev; Giancarlo Pellegrino (DSN, 2025)

Exploring the Design Space for Security Warnings in Immersive Environments. - Andrea Mengascini; Rebecca Weil; Annabelle Walle; Jürgen Steimle; Giancarlo Pellegrino (EuroS&P, 2025)

CHARON: Polyglot Code Analysis for Detecting Vulnerabilities in Scripting Languages Native Extensions. - Raoul Scholtes; Soheil Khodayari; Cristian-Alexandru Staicu; Giancarlo Pellegrino (EuroS&P, 2025)

Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection. - Soheil Khodayari; Kai Glauber; Giancarlo Pellegrino (NDSS, 2025)

YuraScanner: Leveraging LLMs for Task-driven Web App Scanning. - Aleksei Stafeev; Tim Recktenwald; Gianluca De Stefano; Soheil Khodayari; Giancarlo Pellegrino (NDSS, 2025)

Call Me Maybe: Enhancing JavaScript Call Graph Construction using Graph Neural Networks. - Masudul Hasan Masud Bhuiyan; Gianluca De Stefano; Giancarlo Pellegrino; Cristian-Alexandru Staicu (CoRR, 2025)