1. A method comprising: selecting, by a processor of a computer system, an address identifier of a web address with content that is accessible over a computer network; receiving, by the processor, a first response to the address identifier being submitted as a first user having a first security clearance that is not sufficient to access the content, the first response comprising a first response string; and performing by the processor, based upon determining that the first response does not satisfy a first vulnerability condition: receiving, by the processor, a second response to the address identifier submitted as a second user having a second security clearance that is sufficient to access the content, the second response comprising a second response string; reporting, by the processor, a first privilege escalation vulnerability where a comparison of the first response string to the second response string satisfies a second vulnerability condition; and performing, by the processor, based upon determining that the comparison of the first response string to the second response string does not satisfy the second vulnerability condition processes comprising: determining a first term frequency for the first response string; determining a second term frequency for the second response string; comparing the first term frequency and the second term frequency; and reporting a second privilege escalation vulnerability where the comparison of the first term frequency and the second term frequency satisfies a third vulnerability condition.