1. A computer-implemented method for testing an application for cross-site scripting vulnerabilities, comprising the steps of: under control of at least one processor, (a) for at least one field, parameter or Uniform Resource Locator (URL) of the application, submitting a request in which the field, parameter or URL contains a test slug consisting of an encoded or non-encoded test character or a string of test characters between two default slugs; (b) determining when the application returns the test slug with the test character or string of test characters and whether any of the test characters in the test slug are transformed or not transformed in the returned test slug; (c) storing in non-transitory computer memory the result of the determinations made in step (b); (d) repeating steps (a)-(c) for a plurality of different test characters or strings of test characters; (e) generating at least one exploit by automatically determining the sequence of characters needed to create syntactically executable correct code; (f) storing the at least one exploit in non-transitory computer memory; and (g) before steps (a)-(d), (i) for at least one field, parameter or URL of the application, submitting a request in which the parameter, field or URL contains a default slug not having any special characters; and (ii) determining when the application reflects the default slug without any transformation of characters in response to the request, wherein when the application returns the default slug without any transformation of characters, the test slug used in step (a) consists of the encoded or non-encoded test character(s) sandwiched between two default slugs which are the same or different.