Web application penetration test of a 2-factor login