Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have found 2400+ vulnerabilities for Facebook since 2011. But for a smaller website like Coinbase, white hats have only found 200+ vulnerabilities in the past 2 years, despite that both sites have very good bounty incentives.
My question is, are there any measurements for the complexity of a web-application? If so, are there any tools? One requirement is that the measurement shall be made from a black-box view, that is, no access to the source code. Also, it would be good if the complexity measurement is positively correlated with number of vulnerabilities inside the system. Or number of vulnerabilities found by white hat hackers in a year.
One idea is to use web spiders. Web penetrating tools such as Burp Suite has a web spider function. However, web spiders have many issues, such as handling user authentication and dynamically generated contents.