# US 2019/0245884 A1 · Distributed client-side user monitoring and attack system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0245884 A1 - Document ID: US20190245884A1 - Status: Published application - Kind: A1 - Application number: 16/266,967 - Filed: 2019-02-04 - Published: 2019-08-08 - Earliest claimed: 2012-10-12 - Assignees: Trustwave Holdings, Inc. - Applicants: Trustwave Holdings, Inc. - Inventors: Tyler Rorabaugh; Quoc Quach; Matthew Batema; Jim Hong; Scott Parcel - Web page: https://patentgrep.com/patent/US20190245884A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, and apparatus for use in a distributed client-side user monitoring and attack system are disclosed herein. An example method includes providing a first set of instructions from a security application server to a target application server, the first set of instructions to, when executed, cause a client device to transmit a request for an image to the security application server. In response to the request for the image, a connection is opened between the client device and the security application server. Via the connection opened in response to the request for the image, a second set of instructions is provided to cause the client device to perform a vulnerability test on the target application server and communicate a result of the vulnerability test via the connection. ## Claims ### Claim 1 (canceled) ### Claim 2 A tangible machine-readable storage disk or storage device comprising executable instructions which, when executed, cause a client device to at least: retrieve a first set of instructions from a target application server, the first set of instructions to, when executed, cause the client device to transmit a request for an image to a security application server; open, in response to the request for the image, a connection between the client device and the security application server; access, via the connection opened in response to the request for the image, a second set of instructions; and perform, based on the second set of instructions, a vulnerability test on the target application server. ### Claim 3 (depends on 2) The tangible machine-readable storage disk or storage device of claim 2, wherein the second set of instructions cause the client device to capture and transmit user-related data to the security application server. ### Claim 4 (depends on 2) The tangible machine-readable storage disk or storage device of claim 2, wherein the vulnerability test includes crawling the target application server. ### Claim 5 (depends on 2) The tangible machine-readable storage disk or storage device of claim 2, wherein the first set of instructions are script instructions embedded in a webpage. ### Claim 6 (depends on 2) The tangible machine-readable storage disk or storage device of claim 2, wherein the second set of instructions, when executed, cause the client device to communicate a result of the vulnerability test to the security application server. ### Claim 7 (depends on 2) The tangible machine-readable storage disk or storage device of claim 2, wherein the connection is implemented using cross-origin resource sharing. ### Claim 8 A method for causing a vulnerability test to be performed, the method comprising: retrieving a first set of instructions from a target application server, the first set of instructions to, when executed by at least one processor of a client device, cause the at least one processor to transmit a request for an image to a security application server; opening, in response to the request for the image, a connection between the client device and the security application server; accessing, via the connection opened in response to the request for the image, a second set of instructions; and performing, by executing the second set of instructions with the at least one processor, a vulnerability test on the target application server. ### Claim 9 (depends on 8) The method of claim 8, further including capturing and transmitting user-related data from the client device to the security application server. ### Claim 10 (depends on 8) The method of claim 8, wherein the performing of the vulnerability test includes crawling the target application server. ### Claim 11 (depends on 8) The method of claim 8, wherein the first set of instructions are script instructions embedded in a webpage. ### Claim 12 (depends on 8) The method of claim 8, further including communicating a result of the vulnerability test to the security application server. ### Claim 13 (depends on 8) The method of claim 8, wherein the connection is implemented using cross-origin resource sharing. ### Claim 14 A system comprising: a target application server to serve a first set of instructions to a target application executed at a client device, the client device separate from the target application server; and a client device to execute the first set of instructions to establish a communications link with a security application server, the security application server separate from the target application server and the client device, the security application server to provide a second set of instructions to the target application executed at the client device via the communications link, the second set of instructions, when executed, to cause the target application to (1) perform a vulnerability test of the target application server and (2) communicate a result of the vulnerability test to the security application server via the communications link. ### Claim 15 (depends on 14) The system of claim 14, wherein the second set of instructions is to cause the client device to capture and transmit user-related data from the client device to the security application server. ### Claim 16 (depends on 14) The system of claim 14, wherein the vulnerability test, when performed by the client device, includes crawling the target application server. ### Claim 17 (depends on 14) The system of claim 14, wherein the first set of instructions are script instructions embedded in a webpage. ### Claim 18 (depends on 14) The system of claim 14, wherein the target application server is to provide a response to the vulnerability test performed by the target application. ### Claim 19 (depends on 14) The system of claim 14, wherein the communications link is implemented using cross-origin resource sharing.