Application penetration test of REST interfaces in the cloud