Penetration testing for SaaS applications