Ask HN: How do vulnerability scanners perform scans?

Ok, ok - don't downvote this. I'm wonder how a vulnerability scanner of a web application tries to scan for vulnerabilities like XSS, SQL injection if a lot of web servers block automated form submission from happening through measures like Captcha, etc ? Please leave your answer in comments.