Penetration Test of a Web-API