1. A method for detecting security vulnerabilities in web applications, the method comprising: providing a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier; detecting the identifier within the payload received during an interaction with the web application subsequent to the first interaction; determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction; and reporting that the web application is vulnerable to a stored cross-site scripting attack where the identifier is detected within the payload and where the payload instruction did not undergo a security check prior to the execution of the payload instruction.