Later archive addition

Leveraging Flawed Tutorials for Seeding Large-Scale Web Vulnerability Discovery

Tommi Unruh, Bhargava Shastry, Malte Skoruppa, Federico Maggi, Konrad Rieck, Jean-Pierre Seifert and Fabian Yamaguchi · arXiv.org

The paper uses vulnerable code from popular programming tutorials as seeds for large-scale vulnerability discovery. It converts PHP examples into AST and data-flow graph queries, scans 64,415 repositories, and reports 820 analogues with 117 manually verified vulnerabilities, including direct tutorial copies.

Record

Researcher

Tommi Unruh, Bhargava Shastry, Malte Skoruppa, Federico Maggi, Konrad Rieck, Jean-Pierre Seifert and Fabian Yamaguchi

Published by

arXiv.org

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• static-analysis
• code-audit
• large-scale-scan
• vulnerability-research

This page is the archive's own catalogue record. The research is the work of Tommi Unruh, Bhargava Shastry, Malte Skoruppa, Federico Maggi, Konrad Rieck, Jean-Pierre Seifert and Fabian Yamaguchi, first published at the original source. Preserved copies are kept so the citation survives its host.