Web application penetration test of a single-sign-on (SSO) solution