A method, a client, and a system for testing an application. A webpage file includes codes for simulating a malicious attack. The method includes providing, by the test client, a network address of the webpage file to the tested application, wherein when the tested application loads the webpage file according to the network address, the tested application executes the codes comprised in the webpage file to attempt to read content of a private file in a private directory of the tested application. When the tested application successfully reads the content of the private file, the tested application transmits a message carrying the content of the private file to a test server through a local terminal device, wherein the test server determines whether the tested application has a security loophole according to the message transmitted by the tested application.