1. A computer-implemented method using a black-box tester for identifying stored security vulnerabilities in a computer software application having first and second interfaces therein, comprising: detecting, responsive to a first interaction between the tester and the first interface during execution of the computer software application, a first interaction at a location within a persistent data store in which first data is written to the location; detecting, responsive to a second interaction between the tester and the first interface during execution of the computer software application, a second interaction at the location within the persistent data store in which second data is read from the location; recording an association between the first interface and the second interface; providing, to the computer software application and via any interface indicated by the association, test data having a characteristic of a malicious payload; and identifying, based upon the test data being written to the persistent data store at the location, a stored security vulnerability associated with the computer software application, wherein the recorded association includes an identity of the first and second interfaces and the location, and a plurality of interfaces within the computer software application are tested to identify a plurality of associations.