{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,20]],"date-time":"2025-12-20T22:13:13Z","timestamp":1766268793154},"publisher-location":"Berlin, Heidelberg","reference-count":39,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642414879"},{"type":"electronic","value":"9783642414886"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-642-41488-6_16","type":"book-chapter","created":{"date-parts":[[2013,10,1]],"date-time":"2013-10-01T02:05:49Z","timestamp":1380593149000},"page":"231-246","source":"Crossref","is-referenced-by-count":4,"title":["A Survey on Control-Flow Integrity Means in Web Application Frameworks"],"prefix":"10.1007","author":[{"given":"Bastian","family":"Braun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christian v.","family":"Pollak","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Joachim","family":"Posegga","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"16_CR1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1007\/978-3-540-70542-0_7","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"R. Paleari","year":"2008","unstructured":"Paleari, R., Marrone, D., Bruschi, D., Monga, M.: On Race Vulnerabilities in Web Applications. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol.\u00a05137, pp. 126\u2013142. Springer, Heidelberg (2008)"},{"key":"16_CR2","unstructured":"Chen, S.: Session Puzzles - Indirect Application Attack Vectors. White Paper (May 23, 2012), \n                    \n                      http:\/\/puzzlemall.googlecode.com\/files\/Session%20Puzzles%20-%20Indirect%20Application%20Attack%20Vectors%20-%20May%202011%20-%20Whitepaper.pdf"},{"key":"16_CR3","unstructured":"Grossman, J.: Seven Business Logic Flaws That Put Your Website At Risk. White Paper (May 19, 2012), \n                    \n                      https:\/\/www.whitehatsec.com\/assets\/WP_bizlogic092407.pdf"},{"key":"16_CR4","unstructured":"The New York Times: Thieves Found Citigroup Site an Easy Entry (May 24, 2012), \n                    \n                      http:\/\/www.nytimes.com\/2011\/06\/14\/technology\/14security.html"},{"key":"16_CR5","doi-asserted-by":"crossref","unstructured":"Wang, R., Chen, S., Wang, X., Qadeer, S.: How to Shop for Free Online \u2013 Security Analysis of Cashier-as-a-Service Based Web Stores. In: IEEE Symposium on Security and Privacy (2011)","DOI":"10.1109\/SP.2011.26"},{"key":"16_CR6","doi-asserted-by":"crossref","unstructured":"Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., Berners-Lee, T.: Hypertext Transfer Protocol \u2013 HTTP\/1.1. RFC 2616 (June 1999), \n                    \n                      http:\/\/www.w3.org\/Protocols\/rfc2616\/rfc2616.html","DOI":"10.17487\/rfc2616"},{"key":"16_CR7","doi-asserted-by":"crossref","unstructured":"Berners-Lee, T., Fielding, R., Masinter, L.: Uniform Resource Identifiers (URI): Generic Syntax. RFC 2396 (August 1998), \n                    \n                      http:\/\/www.ietf.org\/rfc\/rfc2396.txt","DOI":"10.17487\/rfc2396"},{"key":"16_CR8","doi-asserted-by":"crossref","unstructured":"Jovanovic, N., Kruegel, C., Kirda, E.: Preventing cross site request forgery attacks. In: Securecomm (2006)","DOI":"10.1109\/SECCOMW.2006.359531"},{"key":"16_CR9","unstructured":"OWASP: Race Conditions (May 23, 2012), \n                    \n                      https:\/\/www.owasp.org\/index.php\/Race_Conditions"},{"key":"16_CR10","doi-asserted-by":"crossref","unstructured":"Hall\u00e9, S., Ettema, T., Bunch, C., Bultan, T.: Eliminating Navigation Errors in Web Applications via Model Checking and Runtime Enforcement of Navigation State Machines. In: ASE (2010)","DOI":"10.1145\/1858996.1859044"},{"key":"16_CR11","unstructured":"builtWith: Framework Usage Statistics \u2013 Overview of Statistics for Framework Technologies, \n                    \n                      http:\/\/trends.builtwith.com\/framework"},{"key":"16_CR12","unstructured":"Johnson, R.E., Foote, B.: Designing Reusable Classes. Journal of Object-Oriented Programming\u00a01 (1988)"},{"key":"16_CR13","unstructured":"The Apache Software Foundation: Tapestry, \n                    \n                      http:\/\/tapestry.apache.org\/"},{"key":"16_CR14","unstructured":"Google, Inc.: Google Web Toolkit, \n                    \n                      https:\/\/developers.google.com\/web-toolkit\/"},{"key":"16_CR15","unstructured":"SpringSource: The Spring Framework, \n                    \n                      http:\/\/www.springsource.org\/"},{"key":"16_CR16","unstructured":"EllisLab, Inc.: CodeIgniter, \n                    \n                      http:\/\/ellislab.com\/codeigniter"},{"key":"16_CR17","unstructured":"Cake Software Foundation, Inc.: CakePHP, \n                    \n                      http:\/\/cakephp.org\/"},{"key":"16_CR18","unstructured":"Kohana Team: Kohana, \n                    \n                      http:\/\/kohanaframework.org\/"},{"key":"16_CR19","unstructured":"Microsoft: ASP.NET, \n                    \n                      http:\/\/www.asp.net\/"},{"key":"16_CR20","unstructured":"Microsoft: ASP.NET Web Forms, \n                    \n                      http:\/\/www.asp.net\/web-forms"},{"key":"16_CR21","unstructured":"Microsoft: ASP.NET MVC, \n                    \n                      http:\/\/www.asp.net\/mvc"},{"key":"16_CR22","unstructured":"Microsoft: ASP.NET Web Pages, \n                    \n                      http:\/\/www.asp.net\/web-pages"},{"key":"16_CR23","unstructured":"Hansson, D.H.: Ruby on Rails, \n                    \n                      http:\/\/rubyonrails.org\/"},{"key":"16_CR24","unstructured":"Django Software Foundation: Django, \n                    \n                      https:\/\/www.djangoproject.com\/"},{"key":"16_CR25","unstructured":"Mozilla Developer Network: AJAX, \n                    \n                      https:\/\/developer.mozilla.org\/en-US\/docs\/AJAX"},{"key":"16_CR26","unstructured":"Spring Projects: Spring Web Flow, \n                    \n                      http:\/\/www.springsource.org\/spring-web-flow"},{"key":"16_CR27","unstructured":"OWASP: Failure to Restrict URL Access (May 11, 2012), \n                    \n                      https:\/\/www.owasp.org\/index.php\/Top_10_2010-A8-Failure_to_Restrict_URL_Access"},{"key":"16_CR28","unstructured":"OWASP: Forced Browsing (May 4, 2012), \n                    \n                      https:\/\/www.owasp.org\/index.php\/Forced_browsing"},{"key":"16_CR29","unstructured":"Bray, T.: Deep Linking in the World Wide Web (May 29, 2012), \n                    \n                      http:\/\/www.w3.org\/2001\/tag\/doc\/deeplinking.html"},{"key":"16_CR30","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-642-36563-8_1","volume-title":"Engineering Secure Software and Systems","author":"B. Braun","year":"2013","unstructured":"Braun, B., Gemein, P., Reiser, H.P., Posegga, J.: Control-Flow Integrity in Web Applications. In: J\u00fcrjens, J., Livshits, B., Scandariato, R. (eds.) ESSoS 2013. LNCS, vol.\u00a07781, pp. 1\u201316. Springer, Heidelberg (2013)"},{"key":"16_CR31","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1007\/978-3-540-74320-0_4","volume-title":"Recent Advances in Intrusion Detection","author":"M. Cova","year":"2007","unstructured":"Cova, M., Balzarotti, D., Felmetsger, V., Vigna, G.: Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 63\u201386. Springer, Heidelberg (2007)"},{"key":"16_CR32","doi-asserted-by":"crossref","unstructured":"Li, X., Xue, Y.: BLOCK: A Black-box Approach for Detection of State Violation Attacks Towards Web Applications. In: ACSAC (2011)","DOI":"10.1145\/2076732.2076767"},{"key":"16_CR33","doi-asserted-by":"crossref","unstructured":"Balzarotti, D., Cova, M., Felmetsger, V., Vigna, G.: Multi-Module Vulnerability Analysis of Web-based Applications. In: CCS (2007)","DOI":"10.1145\/1315245.1315250"},{"key":"16_CR34","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"225","DOI":"10.1007\/978-3-642-13739-6_15","volume-title":"Data and Applications Security and Privacy XXIV","author":"K. Jayaraman","year":"2010","unstructured":"Jayaraman, K., Lewandowski, G., Talaga, P.G., Chapin, S.J.: Enforcing Request Integrity in Web Applications. In: Foresti, S., Jajodia, S. (eds.) Data and Applications Security and Privacy XXIV. LNCS, vol.\u00a06166, pp. 225\u2013240. Springer, Heidelberg (2010)"},{"key":"16_CR35","unstructured":"Felmetsger, V., Cavedon, L., Kruegel, C., Vigna, G.: Toward Automated Detection of Logic Vulnerabilities in Web Applications. In: USENIX Security (2010)"},{"key":"16_CR36","unstructured":"Balduzzi, M., Gimenez, C.T., Balzarotti, D., Kirda, E.: Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications. In: NDSS (2011)"},{"key":"16_CR37","doi-asserted-by":"crossref","unstructured":"Bisht, P., Hinrichs, T., Skrupsky, N., Bobrowicz, R., Venkatakrishnan, V.N.: NoTamper: Automatic Blackbox Detection of Parameter Tampering Opportunities in Web Applications. In: CCS (2010)","DOI":"10.1145\/1866307.1866375"},{"key":"16_CR38","doi-asserted-by":"crossref","unstructured":"Vikram, K., Prateek, A., Livshits, B.: Ripley: Automatically Securing Web 2.0 Applications Through Replicated Execution. In: CCS (2009)","DOI":"10.1145\/1653662.1653685"},{"key":"16_CR39","doi-asserted-by":"crossref","unstructured":"Guha, A., Krishnamurthi, S., Jim, T.: Using Static Analysis for Ajax Intrusion Detection. In: WWW (2009)","DOI":"10.1145\/1526709.1526785"}],"container-title":["Lecture Notes in Computer Science","Secure IT Systems"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-41488-6_16","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,17]],"date-time":"2019-05-17T13:52:03Z","timestamp":1558101123000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-41488-6_16"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783642414879","9783642414886"],"references-count":39,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-41488-6_16","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2013]]}}}