Biting the Hand That Serves You: A Closer Look at Client-Side Flash Proxies for Cross-Domain Requests. - Martin Johns; Sebastian Lekies (DIMVA, 2011)

BetterAuth: web authentication revisited. - Martin Johns; Sebastian Lekies; Bastian Braun; Benjamin Flesch (ACSAC, 2012)

DEMACRO: Defense against Malicious Cross-Domain Requests. - Sebastian Lekies; Nick Nikiforakis; Walter Tighzert; Frank Piessens; Martin Johns (RAID, 2012)

Towards stateless, client-side driven Cross-Site Request Forgery protection for Web applications. - Sebastian Lekies; Walter Tighzert; Martin Johns (Sicherheit, 2012)

On the Fragility and Limitations of Current Browser-Provided Clickjacking Protection Schemes. - Sebastian Lekies; Mario Heiderich (WOOT, 2012)

25 million flows later: large-scale detection of DOM-based XSS. - Sebastian Lekies; Ben Stock; Martin Johns (CCS, 2013)

Tamper-Resistant LikeJacking Protection. - Martin Johns; Sebastian Lekies (RAID, 2013)

Eradicating DNS Rebinding with the Extended Same-origin Policy. - Martin Johns; Sebastian Lekies; Ben Stock (USENIX Security Symposium, 2013)

DOM-basiertes Cross-Site Scripting im Web: Reise in ein unerforschtes Land. - Ben Stock; Sebastian Lekies; Martin Johns (Sicherheit, 2014)

Precise Client-side Protection against DOM-based Cross-Site Scripting. - Ben Stock; Sebastian Lekies; Tobias Mueller; Patrick Spiegel; Martin Johns (USENIX Security Symposium, 2014)

From Facepalm to Brain Bender: Exploring Client-Side Cross-Site Scripting. - Ben Stock; Stephan Pfistner; Bernd Kaiser; Sebastian Lekies; Martin Johns (CCS, 2015)

The Unexpected Dangers of Dynamic JavaScript. - Sebastian Lekies; Ben Stock; Martin Wentzel; Martin Johns (USENIX Security Symposium, 2015)

CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy. - Lukas Weichselbaum; Michele Spagnuolo; Sebastian Lekies; Artur Janc (CCS, 2016)

Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script Gadgets. - Sebastian Lekies; Krzysztof Kotowicz; Samuel Groß; Eduardo A. Vela Nava; Martin Johns (CCS, 2017)

JSONPS: Secure an inherently insecure practice with this one weird trick! - Sebastian Lekies; Damien Engels; Metodi Mitkov (EuroS&P Workshops, 2021)

No keys to the kingdom required: a comprehensive investigation of missing authentication vulnerabilities in the wild. - Manuel Karl; Marius Musch; Guoli Ma; Martin Johns; Sebastian Lekies (IMC, 2022)

Client-Side Cross-Site Scripting: Exploitation, Detection, Mitigation, and Prevention. - Sebastian Lekies (2023)