1. A method of testing a Web-based application for security vulnerabilities, the method comprising: communicating at least one client request comprising a payload having a unique identifier to the Web-based application; receiving from the Web-based application response HTML and an associated Document Object Model (DOM) object; via a processor, identifying content corresponding to the payload in the DOM object via the unique identifier; and identifying a section of the DOM object comprising the payload as un-trusted.