{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T16:23:21Z","timestamp":1783787001265,"version":"3.55.0"},"publisher-location":"Berlin, Heidelberg","reference-count":24,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642554148","type":"print"},{"value":"9783642554155","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-642-55415-5_22","type":"book-chapter","created":{"date-parts":[[2014,5,12]],"date-time":"2014-05-12T02:18:10Z","timestamp":1399861090000},"page":"264-277","source":"Crossref","is-referenced-by-count":1,"title":["Ghostrail: Ad Hoc Control-Flow Integrity for Web Applications"],"prefix":"10.1007","author":[{"given":"Bastian","family":"Braun","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Caspar","family":"Gries","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Benedikt","family":"Petschkuhn","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joachim","family":"Posegga","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"22_CR1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"231","DOI":"10.1007\/978-3-642-41488-6_16","volume-title":"Secure IT Systems","author":"B. Braun","year":"2013","unstructured":"Braun, B., Pollak, C.v., Posegga, J.: A Survey on Control-Flow Integrity Means in Web Application Frameworks. In: Riis Nielson, H., Gollmann, D. (eds.) NordSec 2013. LNCS, vol.\u00a08208, pp. 231\u2013246. Springer, Heidelberg (2013)"},{"key":"22_CR2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1007\/978-3-540-70542-0_7","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"R. Paleari","year":"2008","unstructured":"Paleari, R., Marrone, D., Bruschi, D., Monga, M.: On Race Vulnerabilities in Web Applications. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol.\u00a05137, pp. 126\u2013142. Springer, Heidelberg (2008)"},{"key":"22_CR3","unstructured":"Grossman, J.: Seven Business Logic Flaws That Put Your Website At Risk (White Paper), \n                    \n                      https:\/\/www.whitehatsec.com\/assets\/WP_bizlogic092407.pdf\n                    \n                    \n                   (last accessed January 23, 2014)"},{"key":"22_CR4","unstructured":"The New York Times: Thieves Found Citigroup Site an Easy Entry, \n                    \n                      http:\/\/www.nytimes.com\/2011\/06\/14\/technology\/14security.html\n                    \n                    \n                   (last accessed January 23, 2014)"},{"key":"22_CR5","unstructured":"Tate, R.: Apple\u2019s Worst Security Breach: 114,000 iPad Owners Exposed, \n                    \n                      http:\/\/gawker.com\/5559346\/\n                    \n                    \n                   (last accessed January 19, 2014)"},{"key":"22_CR6","doi-asserted-by":"crossref","unstructured":"Wang, R., Chen, S., Wang, X., Qadeer, S.: How to Shop for Free Online \u2013 Security Analysis of Cashier-as-a-Service Based Web Stores. In: IEEE S&P (2011)","DOI":"10.1109\/SP.2011.26"},{"key":"22_CR7","unstructured":"OWASP: Race Conditions, \n                    \n                      https:\/\/www.owasp.org\/index.php\/Race_Conditions\n                    \n                    \n                   (last accessed January 23, 2014)"},{"key":"22_CR8","doi-asserted-by":"crossref","unstructured":"Guha, A., Krishnamurthi, S., Jim, T.: Using Static Analysis for Ajax Intrusion Detection. In: WWW (2009)","DOI":"10.1145\/1526709.1526785"},{"key":"22_CR9","unstructured":"Joyent, Inc: Node.js, \n                    \n                      http:\/\/nodejs.org\n                    \n                    \n                   (last accessed January 22, 2014)"},{"key":"22_CR10","unstructured":"Hidayat, A.: PhantomJS, \n                    \n                      http:\/\/phantomjs.org\n                    \n                    \n                   (last accessed January 22, 2014)"},{"key":"22_CR11","unstructured":"Ilya Kantor: JavaScript Tutorial - Bubbling and capturing, \n                    \n                      http:\/\/javascript.info\/tutorial\/bubbling-and-capturing\n                    \n                    \n                   (last accessed January 22, 2014)"},{"key":"22_CR12","unstructured":"Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., Berners-Lee, T.: HTTP\/1.1. (RFC 2616)"},{"key":"22_CR13","unstructured":"Google: Gruyere, \n                    \n                      http:\/\/google-gruyere.appspot.com\n                    \n                    \n                  , (last accessed January 23, 2014)"},{"key":"22_CR14","unstructured":"SeleniumHQ: Browser Automation, \n                    \n                      http:\/\/docs.seleniumhq.org\n                    \n                    \n                   (last accessed January 23, 14)"},{"key":"22_CR15","unstructured":"OWASP: Failure to Restrict URL Access, \n                    \n                      https:\/\/www.owasp.org\/index.php\/Top_10_2010-A8-Failure_to_Restrict_URL_Access\n                    \n                    \n                   (last accessed January 23, 2014)"},{"key":"22_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"225","DOI":"10.1007\/978-3-642-13739-6_15","volume-title":"Data and Applications Security and Privacy XXIV","author":"M. Abadi","year":"2010","unstructured":"Abadi, M., Cardelli, L., Talaga, P.G., Chapin, S.J.: Enforcing Request Integrity in Web Applications. In: Foresti, S., Jajodia, S. (eds.) Data and Applications Security XXIV. LNCS, vol.\u00a06166, pp. 225\u2013240. Springer, Heidelberg (2010)"},{"key":"22_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-642-36563-8_1","volume-title":"Engineering Secure Software and Systems","author":"B. Braun","year":"2013","unstructured":"Braun, B., Gemein, P., Reiser, H.P., Posegga, J.: Control-Flow Integrity in Web Applications. In: J\u00fcrjens, J., Livshits, B., Scandariato, R. (eds.) ESSoS 2013. LNCS, vol.\u00a07781, pp. 1\u201316. Springer, Heidelberg (2013)"},{"key":"22_CR18","doi-asserted-by":"crossref","unstructured":"Balzarotti, D., Cova, M., Felmetsger, V., Vigna, G.: Multi-Module Vulnerability Analysis of Web-based Applications. In: CCS (2007)","DOI":"10.1145\/1315245.1315250"},{"key":"22_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1007\/978-3-540-74320-0_4","volume-title":"Recent Advances in Intrusion Detection","author":"M. Cova","year":"2007","unstructured":"Cova, M., Balzarotti, D., Felmetsger, V., Vigna, G.: Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol.\u00a04637, pp. 63\u201386. Springer, Heidelberg (2007)"},{"key":"22_CR20","unstructured":"Felmetsger, V., Cavedon, L., Kruegel, C., Vigna, G.: Toward Automated Detection of Logic Vulnerabilities in Web Applications. In: USENIX Security (2010)"},{"key":"22_CR21","doi-asserted-by":"crossref","unstructured":"Li, X., Xue, Y.: BLOCK: A Black-box Approach for Detection of State Violation Attacks Towards Web Applications. In: ACSAC (2011)","DOI":"10.1145\/2076732.2076767"},{"key":"22_CR22","unstructured":"Balduzzi, M., Gimenez, C.T., Balzarotti, D., Kirda, E.: Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications. In: NDSS (2011)"},{"key":"22_CR23","doi-asserted-by":"crossref","unstructured":"Bisht, P., Hinrichs, T., Skrupsky, N., Bobrowicz, R., Venkatakrishnan, V.N.: NoTamper: Automatic Blackbox Detection of Parameter Tampering Opportunities in Web Applications. In: CCS (2010)","DOI":"10.1145\/1866307.1866375"},{"key":"22_CR24","doi-asserted-by":"crossref","unstructured":"Vikram, K., Prateek, A., Livshits, B.: Ripley: Automatically Securing Web 2.0 Applications Through Replicated Execution. In: CCS (2009)","DOI":"10.1145\/1653662.1653685"}],"container-title":["IFIP Advances in Information and Communication Technology","ICT Systems Security and Privacy Protection"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-55415-5_22","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,26]],"date-time":"2019-05-26T19:39:31Z","timestamp":1558899571000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-55415-5_22"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783642554148","9783642554155"],"references-count":24,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-55415-5_22","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"value":"1868-4238","type":"print"},{"value":"1868-422X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014]]}}}