Web application penetration test of two auction platforms