Web application penetration test of a banking protocol and security configuration review of a web application firewall