Security system for detecting malicious actor's observation
A website vulnerability test is performed by automatically checking that a website has not been compromised by malicious third party scripts. A system can test a dynamic behavior of a website that indicates a functional user flow through the website. A set of rules are applied against a log of dynamic behavior of the website, as well as static code of the website, to identify potential compromise by malicious scripts. Some rules can be configured for detecting modification of a third party script, or modified behavior of a third party script, in an attempt to detect security monitoring activity against the script and hide its presence from the security monitoring activity.
1. A method for testing a website vulnerability, the method comprising:
retrieving website code of a website, the website code including a script;
executing the website code with an automation script, the automation script simulating a user interaction with the website;
accessing a console log, wherein the script includes one or more messages, the messages being recorded in the console log as the script is executed;
searching for an indicator of malicious action in the console log, wherein the indicator is indicative of the console lop without the messages;
determining a presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
2. The method of claim 1 , wherein retrieving website code includes retrieving website code on a browser, the method further comprising:
running a code evaluation tool on the browser.
3. The method of claim 2 , wherein the code evaluation tool is built in the browser.
4. The method of claim 2 , wherein the code evaluation tool is configured to insert the messages in the script prior to the execution.
5. The method of claim 1 , wherein the indicator is further indicative of the console log being empty.
6. The method of claim 1 , wherein the indicator is further indicative of the console log being modified.
7. The method of claim 1 , wherein the indicator is further indicative of the console log with the messages being modified.
8. A client computing device for testing a website vulnerability, comprising:
a data processing apparatus; and
a memory device storing instructions that when executed by the data processing apparatus cause the device to perform operations comprising:
retrieving website code of a website on a browser, the website code including a script;
executing the website code with an automation script, the automation script simulating a user interaction with the website;
running a code evaluation tool on the browser;
accessing a console log, wherein the script includes one or more messages, the messages being recorded in the console log as the script is executed;
searching for an indicator of malicious action in the console log, wherein the indicator is indicative of the console log without the messages;
determining a presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
9. The client computing device of claim 8 , wherein the code evaluation tool is configured to insert messages in the script prior to the execution.
10. The client computing device of claim 8 , wherein the indicator is further indicative of the console log being empty.
11. The client computing device of claim 8 , wherein the indicator is further indicative of the console log being modified.
12. The client computing device of claim 8 , wherein the indicator is further indicative of the messages being modified.
13. A method for testing a website vulnerability, the method comprising:
retrieving website code of a website, the website code including a script;
executing the website code with an automation script, the automation script simulating a user interaction with the website;
accessing a console log, wherein the script includes one or more messages, the messages being recorded in the console log as the script is executed;
searching for an indicator of malicious action in the console log, wherein the indicator is indicative of the console log with the messages being modified;
determining a presence of a potential malicious script based on the indicator; and
returning an alert of the presence of the potential malicious script in the website.
14. The method of claim 13 , wherein retrieving website code includes retrieving website code on a browser, the method further comprising:
running a code evaluation tool on the browser.
15. The method of claim 14 , wherein the code evaluation tool is built in the browser.
16. The method of claim 14 , wherein the code evaluation tool is configured to insert the messages in the script prior to the execution.
17. The method of claim 13 , wherein the indicator is further indicative of the console log being empty.
18. The method of claim 13 , wherein the indicator is further indicative of the console log being modified.