1. A method for detecting security vulnerabilities in a web application executing on a web server or web application server, the method comprising: actuating the application in order to discover pre-defined elements of the application's interface with external clients; generating client requests having unauthorized values for said elements in order to generate exploits unique to the application; attacking the application using the exploits; and evaluating the results of the attack.