SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web. - Mikhail Shcherbakov; Musard Balliu (NDSS, 2021)

Friendly Fire: Cross-app Interactions in IoT Platforms. - Musard Balliu; Massimo Merro; Michele Pasqua; Mikhail Shcherbakov (ACM Trans. Priv. Secur., 2021)

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js. - Mikhail Shcherbakov; Musard Balliu; Cristian-Alexandru Staicu (USENIX Security Symposium, 2023)

GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes. - Eric Cornelissen; Mikhail Shcherbakov; Musard Balliu (USENIX Security Symposium, 2024)

Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis. - Mikhail Shcherbakov; Paul Moosbrugger; Musard Balliu (WWW, 2024)