Pseudonyme Biometrik: Ein signatur-basierter Ansatz. - Martin Johns (BIOSIG, 2003)

SessionSafe: Implementing XSS Immune Session Handling. - Martin Johns (ESORICS, 2006)

Protecting the Intranet Against "JavaScript Malware" and Related Attacks. - Martin Johns; Justus Winter (DIMVA, 2007)

SMask: preventing injection attacks in web applications by approximating automatic data/code separation. - Martin Johns; Christian Beyerlein (SAC, 2007)

Automatisierter Code-Audit - Sicherheitsanalyse von Source Code in Theorie und Praxis. - Martin Johns; Daniel Schreckling (Datenschutz und Datensicherheit, 2007)

XSSDS: Server-Side Detection of Cross-Site Scripting Attacks. - Martin Johns; Björn Engelmann 001; Joachim Posegga (ACSAC, 2008)

On JavaScript Malware and related threats. - Martin Johns (J. Comput. Virol., 2008)

09141 Abstracts Collection - Web Application Security. - Dan Boneh; Úlfar Erlingsson; Martin Johns; Benjamin Livshits (Web Application Security, 2009)

09141 Executive Summary - Web Application Security. - Dan Boneh; Úlfar Erlingsson; Martin Johns; Benjamin Livshits (Web Application Security, 2009)

Code-injection Verwundbarkeit in Web Anwendungen am Beispiel von Cross-site Scripting. - Martin Johns (Ausgezeichnete Informatikdissertationen, 2009)

Secure Code Generation for Web Applications. - Martin Johns; Christian Beyerlein; Rosemaria Giesecke; Joachim Posegga (ESSoS, 2010)

Security Challenges of a Changing Energy Landscape. - Marek Jawurek; Martin Johns (ISSE, 2010)

Session Fixation - The Forgotten Vulnerability? - Michael Schrank; Bastian Braun; Martin Johns; Joachim Posegga (Sicherheit, 2010)

Smart metering de-pseudonymization. - Marek Jawurek; Martin Johns; Konrad Rieck (ACSAC, 2011)

Biting the Hand That Serves You: A Closer Look at Client-Side Flash Proxies for Cross-Domain Requests. - Martin Johns; Sebastian Lekies (DIMVA, 2011)

SessionShield: Lightweight Protection against Session Hijacking. - Nick Nikiforakis; Wannes Meert; Yves Younan; Martin Johns; Wouter Joosen (ESSoS, 2011)

Abusing locality in shared web hosting. - Nick Nikiforakis; Wouter Joosen; Martin Johns (EUROSEC, 2011)

Scanstud: A Methodology for Systematic, Fine-Grained Evaluation of Static Analysis Tools. - Martin Johns; Moritz Jodeit (ICST Workshops, 2011)

Plug-In Privacy for Smart Metering Billing. - Marek Jawurek; Martin Johns; Florian Kerschbaum (PETS, 2011)

Reliable protection against session fixation attacks. - Martin Johns; Bastian Braun; Michael Schrank; Joachim Posegga (SAC, 2011)

Code-injection Vulnerabilities in Web Applications - Exemplified at Cross-site Scripting. - Martin Johns (it Inf. Technol., 2011)

Code Injection Vulnerabilities in Web Applications: Exemplified at Cross-site Scripting. - Martin Johns (2011)

Session Hijacking Attacks. - Martin Johns (Encyclopedia of Cryptography and Security (2nd Ed.), 2011)

BetterAuth: web authentication revisited. - Martin Johns; Sebastian Lekies; Bastian Braun; Benjamin Flesch (ACSAC, 2012)

DEMACRO: Defense against Malicious Cross-Domain Requests. - Sebastian Lekies; Nick Nikiforakis; Walter Tighzert; Frank Piessens; Martin Johns (RAID, 2012)

Towards stateless, client-side driven Cross-Site Request Forgery protection for Web applications. - Sebastian Lekies; Walter Tighzert; Martin Johns (Sicherheit, 2012)

A User-Level Authentication Scheme to Mitigate Web Session-Based Vulnerabilities. - Bastian Braun; Stefan Kucher; Martin Johns; Joachim Posegga (TrustBus, 2012)

WebSand: Server-Driven Outbound Web-Application Sandboxing. - Martin Johns; Joachim Posegga (TrustBus, 2012)

Web Application Security (Dagstuhl Seminar 12401). - Lieven Desmet; Martin Johns; Benjamin Livshits; Andrei Sabelfeld (Dagstuhl Reports, 2012)

HTML5-Security - Sicherer Umgang mit den neuen JavaScript APIs. - Martin Johns (Datenschutz und Datensicherheit, 2012)

25 million flows later: large-scale detection of DOM-based XSS. - Sebastian Lekies; Ben Stock; Martin Johns (CCS, 2013)

PreparedJS: Secure Script-Templates for JavaScript. - Martin Johns (DIMVA, 2013)

Tamper-Resistant LikeJacking Protection. - Martin Johns; Sebastian Lekies (RAID, 2013)

Eradicating DNS Rebinding with the Extended Same-origin Policy. - Martin Johns; Sebastian Lekies; Ben Stock (USENIX Security Symposium, 2013)

Protecting users against XSS-based password manager abuse. - Ben Stock; Martin Johns (AsiaCCS, 2014)

PhishSafe: leveraging modern JavaScript API's for transparent and robust protection. - Bastian Braun; Martin Johns; Johannes Köstler; Joachim Posegga (CODASPY, 2014)

A Trusted UI for the Mobile Web. - Bastian Braun; Johannes Köstler; Joachim Posegga; Martin Johns (SEC, 2014)

DOM-basiertes Cross-Site Scripting im Web: Reise in ein unerforschtes Land. - Ben Stock; Sebastian Lekies; Martin Johns (Sicherheit, 2014)

Precise Client-side Protection against DOM-based Cross-Site Scripting. - Ben Stock; Sebastian Lekies; Tobias Mueller; Patrick Spiegel; Martin Johns (USENIX Security Symposium, 2014)

Real-Time Communications Security on the Web. - Lieven Desmet; Martin Johns (IEEE Internet Comput., 2014)

Script-templates for the Content Security Policy. - Martin Johns (J. Inf. Secur. Appl., 2014)

Preface. - Lieven Desmet; Martin Johns; Benjamin Livshits; Andrei Sabelfeld (J. Comput. Secur., 2014)

Primer on Client-Side Web Security - Philippe De Ryck; Lieven Desmet; Frank Piessens; Martin Johns (Springer, 2014)

From Facepalm to Brain Bender: Exploring Client-Side Cross-Site Scripting. - Ben Stock; Stephan Pfistner; Bernd Kaiser; Sebastian Lekies; Martin Johns (CCS, 2015)

LogSec: adaptive protection for the wild wild web. - Bastian Braun; Korbinian Pauli; Joachim Posegga; Martin Johns (SAC, 2015)

The Unexpected Dangers of Dynamic JavaScript. - Sebastian Lekies; Ben Stock; Martin Wentzel; Martin Johns (USENIX Security Symposium, 2015)

POSTER: Mapping the Landscape of Large-Scale Vulnerability Notifications. - Ben Stock; Giancarlo Pellegrino; Christian Rossow; Martin Johns; Michael Backes 001 (CCS, 2016)

Ensuring endpoint authenticity in WebRTC peer-to-peer communication. - Willem De Groef; Deepak Subramanian; Martin Johns; Frank Piessens; Lieven Desmet (SAC, 2016)

Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification. - Ben Stock; Giancarlo Pellegrino; Christian Rossow; Martin Johns; Michael Backes 001 (USENIX Security Symposium, 2016)

Security Testing: A Survey. - Michael Felderer; Matthias Büchler; Martin Johns; Achim D. Brucker; Ruth Breu; Alexander Pretschner (Adv. Comput., 2016)

Client-Side XSS in Theorie und Praxis. - Ben Stock; Martin Johns (Datenschutz und Datensicherheit, 2016)

Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script Gadgets. - Sebastian Lekies; Krzysztof Kotowicz; Samuel Groß; Eduardo A. Vela Nava; Martin Johns (CCS, 2017)

Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs. - Giancarlo Pellegrino; Martin Johns; Simon Koch 001; Michael Backes 001; Christian Rossow (CCS, 2017)

How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security. - Ben Stock; Martin Johns; Marius Steffens; Michael Backes 001 (USENIX Security Symposium, 2017)

Towards an Automatic Generation of Low-Interaction Web Application Honeypots. - Marius Musch; Martin Härterich; Martin Johns (ARES, 2018)

Web-based Cryptojacking in the Wild. - Marius Musch; Christian Wressnegger; Martin Johns; Konrad Rieck (CoRR, 2018)

Web Application Security (Dagstuhl Seminar 18321). - Martin Johns; Nick Nikiforakis; Melanie Volkamer; John Wilander (Dagstuhl Reports, 2018)

Thieves in the Browser: Web-based Cryptojacking in the Wild. - Marius Musch; Christian Wressnegger; Martin Johns; Konrad Rieck (ARES, 2019)

ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices. - Marius Musch; Marius Steffens; Sebastian Roth; Ben Stock; Martin Johns (AsiaCCS, 2019)

New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild. - Marius Musch; Christian Wressnegger; Martin Johns; Konrad Rieck (DIMVA, 2019)

Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild. - Marius Steffens; Christian Rossow; Martin Johns; Ben Stock (NDSS, 2019)

Towards Enabling Secure Web-Based Cloud Services using Client-Side Encryption. - Martin Johns; Alexandra Dirksen (CCSW, 2020)

Raccoon: automated verification of guarded race conditions in web applications. - Simon Koch 001; Tim Sauer; Martin Johns; Giancarlo Pellegrino (SAC, 2020)

Hybrid taint analysis for Java EE. - Florian D. Loch; Martin Johns; Martin Hecker 001; Martin Mohr; Gregor Snelting (SAC, 2020)

Adversarial Preprocessing: Understanding and Preventing Image-Scaling Attacks in Machine Learning. - Erwin Quiring; David Klein 001; Daniel Arp; Martin Johns; Konrad Rieck (USENIX Security Symposium, 2020)

Talking About My Generation: Targeted DOM-based XSS Exploit Generation using Dynamic Data Flow Analysis. - Souphiane Bensalim; David Klein 001; Thomas Barber; Martin Johns (EuroSec@EuroSys, 2021)

Who's Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI. - Marius Steffens; Marius Musch; Martin Johns; Ben Stock (NDSS, 2021)

U Can't Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild. - Marius Musch; Martin Johns (USENIX Security Symposium, 2021)

LogPicker: Strengthening Certificate Transparency Against Covert Adversaries. - Alexandra Dirksen; David Klein 001; Robert Michael; Tilman Stehr; Konrad Rieck; Martin Johns (Proc. Priv. Enhancing Technol., 2021)

Accept All Exploits: Exploring the Security Impact of Cookie Banners. - David Klein 001; Marius Musch; Thomas Barber; Moritz Kopmann; Martin Johns (ACSAC, 2022)

Server-Side Browsers: Exploring the Web's Hidden Attack Surface. - Marius Musch; Robin Kirchner; Max Boll; Martin Johns (AsiaCCS, 2022)

Hand Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer Functions. - David Klein 001; Thomas Barber; Souphiane Bensalim; Ben Stock; Martin Johns (EuroS&P, 2022)

No keys to the kingdom required: a comprehensive investigation of missing authentication vulnerabilities in the wild. - Manuel Karl; Marius Musch; Guoli Ma; Martin Johns; Sebastian Lekies (IMC, 2022)

Keeping Privacy Labels Honest. - Simon Koch 001; Malte Wessels; Benjamin Altpeter; Madita Olvermann; Martin Johns (Proc. Priv. Enhancing Technol., 2022)

General Data Protection Runtime: Enforcing Transparent GDPR Compliance for Existing Applications. - David Klein 001; Benny Rolle; Thomas Barber; Manuel Karl; Martin Johns (CCS, 2023)

Poster: The Risk of Insufficient Isolation of Database Transactions in Web Applications. - Simon Koch 001; Malte Wessels; David Klein 001; Martin Johns (CCS, 2023)

FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities. - Samuel Groß; Simon Koch 001; Lukas Bernhard; Thorsten Holz; Martin Johns (NDSS, 2023)

The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications. - Simon Koch 001; Benjamin Altpeter; Martin Johns (USENIX Security Symposium, 2023)

Continuous Health Monitoring on Shared Mobility Devices: A Health-eScooter Prototype. - Joana M. Warnecke; Christian Baumgartner; Michael H. Breitner; Dominique F. Briechle; Thomas M. Deserno; Maximilian Heumann; Martin Johns; Alexander Picker; Andreas Rausch 001; Lars C. Wolf (HICSS, 2024)

Don't Patch the Researcher, Patch the Game: A Systematic Approach for Responsible Research via Federated Ethics Boards. - Alexandra Dirksen; Sebastian Giessler; Hendrik Erz; Martin Johns; Tobias Fiebig (NSPW, 2024)

Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials. - David Klein 001; Martin Johns (SP, 2024)

Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting. - Robin Kirchner; Jonas Möller; Marius Musch; David Klein 001; Konrad Rieck; Martin Johns (USENIX Security Symposium, 2024)

SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications. - Malte Wessels; Simon Koch 001; Giancarlo Pellegrino; Martin Johns (USENIX Security Symposium, 2024)

FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Entropy-based Thresholds. - Soumaya Boussaha; Lukas Hock; Miguel Bermejo; Rubén Cuevas Rumín; Ángel Cuevas Rumín; David Klein 001; Martin Johns; Luca Compagna; Daniele Antonioli; Thomas Barber (Proc. Priv. Enhancing Technol., 2024)

A Black-Box Privacy Analysis of Messaging Service Providers' Chat Message Processing. - Robin Kirchner; Simon Koch 001; Noah Kamangar; David Klein 001; Martin Johns (Proc. Priv. Enhancing Technol., 2024)

Privacy-Preserving Encoding and Scaling of Tabular Data in Horizontal Federated Learning Systems. - Tim Piotrowski; Zoltán Nochta; Manuel Karl; Martin Johns (ARES (1), 2025)

The Importance of Being Earnest: Shedding Light on Johnny's (False) Sense of Privacy. - Wirawan Agahari; Alexandra Dirksen; Martin Johns; Mark de Reuver; Tobias Fiebig (SP, 2025)

"Sorry for Bugging you so much." Exploring Developers' Behavior Towards Privacy-Compliant Implementation. - Stefan Albert Horstmann; Sandy Hong; David Klein 001; Raphael Serafini; Martin Degeling; Martin Johns; Veelasha Moonsamy; Alena Naiakshina (SP, 2025)

Extract: A PHP Foot-Gun Case Study. - Jannik Hartung; Simon Koch 001; Martin Johns (WOOT, 2025)

Comma Separated Vulnerabilities: Detecting Formula Injection in the Wild. - Manuel Karl; Louis Bettels; Martin Johns; David Klein 001 (WOOT, 2025)

Wemby's Web: Hunting for Memory Corruption in WebAssembly. - Oussama Draissi; Tobias Cloosters; David Klein 001; Michael Rodler; Marius Musch; Martin Johns; Lucas Davi (Proc. ACM Softw. Eng., 2025)

Making Web Applications GDPR Compliant: A Comparative Evaluation of GDPR-Enforcement Frameworks. - Felix Kalinowski; David Klein 001; Martin Johns; Veelasha Moonsamy (Proc. Priv. Enhancing Technol., 2025)

The Impact of Default Mobile SDK Usage on Privacy and Data Protection. - Simon Koch 001; Manuel Karl; Robin Kirchner; Malte Wessels; Anne Paschke; Martin Johns (Proc. Priv. Enhancing Technol., 2025)