WEB APPLICATION PENETRATION TESTING: FINDING AND FIXING VULNERABILITIES