Google Online Security Blog: Automating web application security testing
http://googleonlinesecurity.blogspot.com/2007/07/automating-web-application-security.html