Web application penetration test of a client portal