Penetration testing for multi-tenant databases