Toward black-box detection of logic flaws in web applications