1. A computer hardware testing system for detecting security vulnerability in a web application, comprising: a hardware processor configured to initiate the executable operations of: providing, to the web application and during a first interaction with the web application on a computer server, a payload including payload instruction and an identifier distinct from the payload instruction; detecting, within the payload received during an interaction with the web application subsequent to the first interaction, the identifier; and determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.