A system for detecting vulnerabilities in a web application, the system comprising: a programmable processor ; and a non-transitory machine-readable medium comprising instructions thereon that, when executed by the programmable processor , cause the programmable processor to perform operations comprising: directing a plurality of request messages to a web application executed at a remote computing device , the remote computing device executing a system under test , which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request , state changing requests corresponding to request messages that change the state of a user and/or of the system under test , the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message . a programmable processor ; and a non-transitory machine-readable medium comprising instructions thereon that, when executed by the programmable processor , cause the programmable processor to perform operations comprising: directing a plurality of request messages to a web application executed at a remote computing device , the remote computing device executing a system under test , which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request , state changing requests corresponding to request messages that change the state of a user and/or of the system under test , the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message . directing a plurality of request messages to a web application executed at a remote computing device , the remote computing device executing a system under test , which may be or include all or part of the web application; characterized by determining that a first request message of the plurality of request messages describes a state changing request , state changing requests corresponding to request messages that change the state of a user and/or of the system under test , the determining based at least in part on the first request message and a first response message generated by the web application in response to the first request message; generating a first tampered request message based at least in part on the first request message; directing the first tampered request message to the web application; and determining that the first request message indicates a vulnerability of the web application, the determining based at least in part on a comparison between the first tampered request message and a first traffic-tampered response message generated by the web application in response to the first tampered request message . <EOS>