1. A method, comprising: identifying, via a computer processor, security tokens to be used to test defense measures of a web application; determining combinations of the security tokens that are related to classifications of the defense measures; executing, via the computer processor, one of the combinations of the security tokens at an input point of the web application; and determining, via the computer processor, a classification for a defense measure of the web application based on an output of the web application in response to the executed one of the combinations; wherein determining the classification for defense measures comprises mapping combinations of security tokens to each other based on the output of the web application.