A method comprising: receiving, at data processing hardware , a web page ; determining, by the data processing hardware , that the web page implements an interpreted programming language framework with client-side templating; extracting, by the data processing hardware , a version of the interpreted programming language framework and an interpolation sign from the web page ; generating, by the data processing hardware , an attack payload for at least one injection vulnerability context of the web page based on the version of the interpreted programming language framework and the interpolation sign , wherein: executing the modified web page causes the modified web page to throw an exception triggered by the attack payload , or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware ; instrumenting, by the data processing hardware , the web page to inject the attack payload into the at least one injection vulnerability context of the web page ; executing, by the data processing hardware , the instrumented web page ; catching, by the data processing hardware , the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page ; and identifying, by the data processing hardware , a vulnerability of the web page based on the thrown exception or the response of the validation function . receiving, at data processing hardware , a web page ; determining, by the data processing hardware , that the web page implements an interpreted programming language framework with client-side templating; extracting, by the data processing hardware , a version of the interpreted programming language framework and an interpolation sign from the web page ; generating, by the data processing hardware , an attack payload for at least one injection vulnerability context of the web page based on the version of the interpreted programming language framework and the interpolation sign , wherein: executing the modified web page causes the modified web page to throw an exception triggered by the attack payload , or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware ; instrumenting, by the data processing hardware , the web page to inject the attack payload into the at least one injection vulnerability context of the web page ; executing, by the data processing hardware , the instrumented web page ; catching, by the data processing hardware , the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page ; and identifying, by the data processing hardware , a vulnerability of the web page based on the thrown exception or the response of the validation function . executing the modified web page causes the modified web page to throw an exception triggered by the attack payload , or the attack payload comprises a validation function configured to validate execution of the validation function to the data processing hardware ; instrumenting, by the data processing hardware , the web page to inject the attack payload into the at least one injection vulnerability context of the web page ; executing, by the data processing hardware , the instrumented web page ; catching, by the data processing hardware , the thrown exception or a response of the validation function triggered by the attack payload during execution of the instrumented web page ; and identifying, by the data processing hardware , a vulnerability of the web page based on the thrown exception or the response of the validation function . <EOS>