1. A system for detecting security vulnerabilities in web applications, the system comprising: a black-box tester configured to interact with a web application at a computer server during its execution at the computer server, and identify client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server; and a client-side evaluator configured to evaluate the client-side instructions identified by the black-box tester, and identify a security vulnerability associated with the client-side instructions.