A system (100, 300, 500) for detecting vulnerabilities in a web application, the system (100, 300, 500) comprising: a programmable processor; and a non-transitory machine-readable medium comprising instructions thereon that, when executed by the programmable processor, cause the programmable processor to perform operations comprising: directing a plurality of request messages to a web application executed at a remote computing device, the remote computing device executing a system under test (116, 304), which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request (132, 342), state changing requests (132, 342) corresponding to request messages that change the state of a user (103, 310) and/or of the system under test (116, 304), the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message. a programmable processor; and a non-transitory machine-readable medium comprising instructions thereon that, when executed by the programmable processor, cause the programmable processor to perform operations comprising: directing a plurality of request messages to a web application executed at a remote computing device, the remote computing device executing a system under test (116, 304), which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request (132, 342), state changing requests (132, 342) corresponding to request messages that change the state of a user (103, 310) and/or of the system under test (116, 304), the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message. directing a plurality of request messages to a web application executed at a remote computing device, the remote computing device executing a system under test (116, 304), which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request (132, 342), state changing requests (132, 342) corresponding to request messages that change the state of a user (103, 310) and/or of the system under test (116, 304), the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message.