Penetration test of a web application for use by external asset managers