1. A computer-implemented method for security testing of web applications with specialized payloads, the method comprising: submitting to a web application a payload based on a set of constraints of the payload, the set of constraints of the payload being in form of tokens sanitizable by a server hosting the web application, the submitting being at least a portion of a vulnerability test for the web application, and the vulnerability test being a test for cross-site scripting; receiving a response from the web application; deriving one or more constraints from the response; updating, by a computer processor, the set of constraints of the payload with the derived one or more constraints to generate an updated set of constraints; synthesizing, by the computer processor, an updated payload based on the updated set of constraints, the updated payload being submittable as input to the web application for testing the web application; iterating the vulnerability test one or more times by submitting to the web application the updated payload based on the updated set of constraints; and determining, in response to the vulnerability test, that no vulnerability is identifiable in the web application, responsive to a failure to synthesize a new updated payload during the iterating.