Penetration test of an external web application to access sensitive data