1. A method, comprising: identifying security tokens to be used to test defense measures of a web application; determining combinations of the security tokens that are related to classifications of the defense measures; executing one of the combinations of the security tokens at an input point of the web application; and determining a classification for a defense measure of the web application based on an output of the web application in response to the executed one of the combinations.