A method comprising: receiving, at data processing hardware, a web page; determining, by the data processing hardware, that the web page implements an interpreted programming language framework with client-side templating; extracting, by the data processing hardware, a version of the interpreted programming language framework and an interpolation sign from the web page; generating, by the data processing hardware, an attack payload for at least one injection vulnerability context of the web page based on the version of the interpreted programming language framework and the interpolation sign, wherein: executing the modified web page causes the modified web page to throw an exception triggered by the attack payload, or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware; instrumenting, by the data processing hardware, the web page to inject the attack payload into the at least one injection vulnerability context of the web page; executing, by the data processing hardware, the instrumented web page; catching, by the data processing hardware, the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page; and identifying, by the data processing hardware, a vulnerability of the web page based on the thrown exception or the response of the validation function. receiving, at data processing hardware, a web page; determining, by the data processing hardware, that the web page implements an interpreted programming language framework with client-side templating; extracting, by the data processing hardware, a version of the interpreted programming language framework and an interpolation sign from the web page; generating, by the data processing hardware, an attack payload for at least one injection vulnerability context of the web page based on the version of the interpreted programming language framework and the interpolation sign, wherein: executing the modified web page causes the modified web page to throw an exception triggered by the attack payload, or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware; instrumenting, by the data processing hardware, the web page to inject the attack payload into the at least one injection vulnerability context of the web page; executing, by the data processing hardware, the instrumented web page; catching, by the data processing hardware, the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page; and identifying, by the data processing hardware, a vulnerability of the web page based on the thrown exception or the response of the validation function. executing the modified web page causes the modified web page to throw an exception triggered by the attack payload, or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware; instrumenting, by the data processing hardware, the web page to inject the attack payload into the at least one injection vulnerability context of the web page; executing, by the data processing hardware, the instrumented web page; catching, by the data processing hardware, the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page; and identifying, by the data processing hardware, a vulnerability of the web page based on the thrown exception or the response of the validation function.