Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks. - Avinash Sudhodanan; Soheil Khodayari; Juan Caballero (NDSS, 2020)

Where We Stand (or Fall): An Analysis of CSRF Defenses in Web Frameworks. - Xhelal Likaj; Soheil Khodayari; Giancarlo Pellegrino (RAID, 2021)

JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals. - Soheil Khodayari; Giancarlo Pellegrino (USENIX Security Symposium, 2021)

The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies. - Soheil Khodayari; Giancarlo Pellegrino (SP, 2022)

It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses. - Soheil Khodayari; Giancarlo Pellegrino (SP, 2023)

The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web. - Soheil Khodayari; Thomas Barber; Giancarlo Pellegrino (SP, 2024)

Exploration of the Dynamics of Buy and Sale of Social Media Accounts. - Mario Beluri; Bhupendra Acharya; Soheil Khodayari; Giada Stivala; Giancarlo Pellegrino; Thorsten Holz (CoRR, 2024)

Security testing at scale: studying emerging client-side vulnerabilities in the modern web. - Soheil Khodayari (2024)

In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web. - Jan Drescher; Sepehr Mirzaei; Soheil Khodayari; David Klein 001; Thomas Barber; Martin Johns; Giancarlo Pellegrino (CCS, 2025)

Permission Rationales in the Web Ecosystem: An Exploration of Rationale Text and Design Patterns. - Yusra Elbitar; Soheil Khodayari; Marian Harbach; Gianluca De Stefano; Balazs Csaba Engedy; Giancarlo Pellegrino; Sven Bugiel (CHI, 2025)

CHARON: Polyglot Code Analysis for Detecting Vulnerabilities in Scripting Languages Native Extensions. - Raoul Scholtes; Soheil Khodayari; Cristian-Alexandru Staicu; Giancarlo Pellegrino (EuroS&P, 2025)

Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection. - Soheil Khodayari; Kai Glauber; Giancarlo Pellegrino (NDSS, 2025)

YuraScanner: Leveraging LLMs for Task-driven Web App Scanning. - Aleksei Stafeev; Tim Recktenwald; Gianluca De Stefano; Soheil Khodayari; Giancarlo Pellegrino (NDSS, 2025)