Back to results
US 11,444,970 B2Granted
Dynamic security test system
AssigneeTarget Brands, Inc.
InventorsPaul Melson, Chris Carlson, Eric Brandel, Caleb Walch, Richard Agostino
Life of this patent
Estimating the term…
Abstract
A website vulnerability test is performed by automatically checking that a website has not been compromised by malicious third party scripts. A system can test a dynamic behavior of a website that indicates a functional user flow through the website. Instead of merely analyzing static code of a website, the system automatically tests the website in their runtime environments for the presence of malicious third party scripts.
Claims20
A method for testing a website vulnerability, the method comprising:
- transmitting, from a website security test server to a test client device, a website testing wrapper and an automation script, wherein the website testing wrapper is executable by the test client device to test one or more websites, wherein the test client device is simulated in a testing environment that is isolated from the website security test server and a plurality of actual client devices interacting the one or more websites, and wherein the automation script is configured to automatically simulate a series of user actions of users performed on the test client device to interact with the one or more websites;
- and
- executing, using the test client device, the website testing wrapper and the automation script in the testing environment isolated from the website security test server and the plurality of actual client devices, the executing including:
- receiving, at the test client device, an input of a URL of a target website, the target website being hosted by a web server that is different from the website security test server;
- transmitting, using the test client device and to the web server, a request for the target website, the request including the received URL of the target website;
- retrieving, from the web server and using the test client device, website code of the target website, the website code identifying a script that is part of the target web site;
- transmitting, by the test client device and to a script server, a request for the script;
- receiving, from the script server and at the test client device, the script identified by the website code;
- establishing, at the test client device and based on the website testing wrapper, hooks configured to intercept operations of the retrieved website code and the received script while the target website runs in real time on the test client device;
- generating, by the automation script running at the test client device, simulated user inputs that interact with the target website;
- executing, by the automation script running at the test client device and based on the simulated user inputs, the retrieved website code and the received script within the website testing wrapper;
- monitoring, by the automation script running at the test client device, a dynamic behavior of the target website including a functional user flow through the target website based on the simulated user inputs, by intercepting, using the hooks, the operations of the retrieved website code and the received script according to the simulated user inputs;
- generating, by the automation script running at the test client device, a log of the dynamic behavior;
- and
- transmitting, by the test client device and to the website security test server, the log of the dynamic behavior, wherein the log of dynamic behavior indicates whether the script retrieved and run as part of the target website is malware.
12 more elements
A client computing device for testing a website vulnerability, comprising:
- a data processing apparatus;
- and
- a memory device storing instructions that when executed by the data processing apparatus cause the client computing device to perform operations comprising:
- receiving, from a website security test server, a website testing wrapper and an automation script, wherein the website testing wrapper is executable by the client computing device to test one or more websites, wherein the client computing device is simulated in a testing environment that is isolated from the website security test server and a plurality of other client devices interacting the one or more websites, and wherein the automation script is configured to automatically simulate a series of user actions of users performed on the client computing device to interact with the one or more websites;
- and
- executing the website testing wrapper and the automation script in the testing environment isolated from the website security test server and the plurality of other client devices, the executing including:
- receiving an input of a URL of a target website, the target website hosted by a web server that is different from the website security test server;
- transmitting, to the web server, a request for the target website, the request including the received URL of the target website;
- receiving, from the web server, website code of the target website, the website code identifying a script that is part of the target website;
- receiving, from a script server, the script identified by the web site code;
- establishing, based on the website testing wrapper, hooks configured to intercept operations of the retrieved website code and the received script while the target website runs in real time on the client computing device;
- generating, by the automation script, simulated user inputs that interact with the target website;
- executing, by the automation script and based on the simulated user inputs, the retrieved website code and the received script within the website testing wrapper;
- monitoring, by the automation script, a dynamic behavior of the target website including a functional user flow through the target website based on the simulated user inputs, by intercepting, using the hooks, the operations of the retrieved website code and the received script according to the simulated user inputs;
- generating, by the automation script, a log of the dynamic behavior;
- and
- transmitting, to the website security test server, the log of the dynamic behavior, wherein the log of dynamic behavior indicates whether the script retrieved and run as part of the target website is malware.
14 more elements
A non-transitory computer-readable medium having stored therein a program for causing a computer to execute a process of testing a website vulnerability, the process comprising:
- receiving, from a website security test server, a website testing wrapper and an automation script, wherein the website testing wrapper is executable to test one or more websites, wherein the computer is simulated in a testing environment that is isolated from the website security test server and a plurality of client devices interacting the one or more websites, and wherein the automation script is configured to automatically simulate a series of user actions of users performed on the computer to interact with the one or more websites;
- executing the website testing wrapper and the automation script in the testing environment isolated from the website security test server and the plurality of client devices;
- receiving an input of a URL of a target website, the target website hosted by a web server that is different from the website security test server;
- transmitting the URL to the web server to retrieve website code of the target web site;
- receiving the website code of the target website from the web server, the website code identifying a third party script that is part of the target website;
- receiving, from a third party script server different from the web server, the third party script identified by the website code;
- establishing, based on the website testing wrapper, hooks configured to intercept operations of the retrieved website code and the received third party script while the target website runs in real time on the computer;
- generating, by the automation script, simulated user inputs that interact with the target website;
- executing, by the automation script and based on the simulated user inputs, the website code and the third party script within the website testing wrapper;
- monitoring, by the automation script, a dynamic behavior of the target website interacting with the simulated user inputs, by intercepting, using the hooks, the operations of the website code and the third party script according to the simulated user inputs;
- generating, by the automation script, a log of the dynamic behavior;
- and
- transmitting, to the website security test server, the log of the dynamic behavior, wherein the log of the dynamic behavior indicates whether the third party script retrieved and run as part of the target website is malware.
10 more elements
Dependencies are inferred from the claim text.