Detecting Injection Vulnerabilities of Client-Side Templating Systems

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving a web page request for a web page;
• generating an attack payload for an injection vulnerability context of the web page;
• instrumenting the web page to inject the attack payload by injecting the attack payload into one or more possible input vectors associated with the injection vulnerability context;
• executing the instrumented web page;
• catching a thrown exception triggered by the attack payload during execution of the instrumented web page;
• and
• identifying a vulnerability of the web page based on the thrown exception.