New research shows how known techniques for finding weaknesses in websites are actually practical in uncovering vulnerabilities, for better or worse.