Matteo Golinelli

Matteo Golinelli

CyberSecurity PhD Student

University of Trento

My research interests include web security, with special focus on web caches.

Interests

Web security, caches and proxies
Cloud security
CTF

Education

PhD in CyberSecurity, 2021-
University of Trento
Master in CyberSecurity, 2021
University of Trento
BsC in Computer Science, 2019
University of Trento

News

January, 2025: I will be at ITASEC 25 in Bologna between February 3-7, 2025 to present Hidden Web Caches Discovery.
September, 2024: I will be at RAID 2024 in Padua, Italy between September 30 and October 2, 2024 to present Hidden Web Caches Discovery.
July, 2024: Between August and October 2024 I will be doing a research internship at Dynatrace in Linz, Austria.

January, 2024: Our paper OAuth 2.0 Redirect URI Validation Falls Short Literally has been nominated for the Top 10 Web Hacking Techniques of 2023.

Recent Publications

Matteo Golinelli, Bruno Crispo (2024). Hidden Web Caches Discovery. RAID 2024.

PDF Cite Code DOI

Tommaso Innocenti, Matteo Golinelli, Kaan Onarlioglu, Ali Mirheidari, Bruno Crispo, Engin Kirda (2023). OAuth 2.0 Redirect URI Validation Falls Short Literally. ACSAC 2023.

PDF Cite Code DOI

Matteo Golinelli, Francesco Bonomi, Bruno Crispo (2023). The Nonce-nce of Web Security: An Investigation of CSP Nonces Reuse. WASP @ ESORICS 2023.

Cite Code arXiv On Springer (paid access)

Matteo Golinelli, Elham Arshad, Dmytro Kashchuk, Bruno Crispo (2023). Mind the CORS. IEEE TPS 2023.

PDF Cite Code IEEE Xplore

Seyed Ali Mirheidari, Matteo Golinelli, Kaan Onarlioglu, Engin Kirda, Bruno Crispo (2022). Web Cache Deception Escalates!. In USENIX.

PDF Cite Code Slides Video On USENIX

Recent Posts

Can the Date Header Be Used to Detect Caching?

No. But actually, not really. Web Caches Let’s start with some background. Web caches are in-the-middle components physically located between a client and an origin web server. They are used to reduce the latency of HTTP requests by storing the responses of the server and serving them to the client when the same request is made again. Moreover, web caches are used to reduce the load on the origin web servers. Web caches can be placed anywhere in the path between the client and the origin web server. Content Delivery Networks (CDNs) are a type of web caches that is geographically distributed and are usually placed as close as possible to the client, reducing the latency of the requests.

Nov 15, 2023

Web Cache Deception leads to Cache Poisoning

Web Cache Deception leads to Cache Poisoning

Web cache poisoning is an attack that allows an attacker to trick a web cache into storing malicious content (such as malicious JavaScript). This content is then served to all the unsuspecting users that request the poisoned URL 1.

Aug 20, 2023

Reply Cyber Security Challenge 2022: Web200 Writeup

Reply Cyber Security Challenge 2022: Web200 Writeup

I took part to the Reply Cyber Security Challenge 2022, a CTF organized by Reply, with a team of friends from the University of Trento. This is the writeup of the Web200 challenge.

Oct 17, 2022