A method for securely testing a web application is provided. The method may include analyzing each HTTP log entry that may be included in a centralized web server log file of a web application. Each HTTP log entry may include an endpoint. The endpoint may be a URL path correlating to a location on the web application. Based on the analysis, the method may include identifying each endpoint included in the web application and generating a first web application site-map based on each identified endpoint. The method may further include determining one or more endpoints on the first web application site map, that may be absent from a second web application site map. The second web application site map may include each crawled endpoint within the web application identified via a crawling of the web application by a web application attack tool for identifying security vulnerabilities.