1. A system comprising: a processor; and a non-transitory computer-readable data storage medium storing instructions executable by the processor to: load a web application having a complex Document Object Model (DOM); traverse a structure of the web application based on rules to transform the complex DOM of the web application into a set of actionable tokens representing a portion of user interface elements of the web application; present a part of the web application with the portion of the user interface elements highlighted; permit the user to update the rules to selectively add and remove the user interface elements of the web application that are represented by the set of actionable tokens to which the complex DOM of the web application is transformed based on the rules; discover an application attack surface of the web application used within security vulnerability testing of the web application by simulating user actions on the user interface elements of the web application that are represented by the set of actionable tokens to which the complex DOM of the web application is transformed based on the updated rules; receive selection input to select a user interface element presented on the part, but not part of the highlighted user interface elements; flag the user interface element for creating a rule; and generate and cause storage of a type associated with the user interface element, an access identifier associated with the user interface element, one or more event handlers associated with the user interface element, and relationship information within the document object model.