Web application penetration test of a BPM portal and the associated administrative interfaces