Web application and API penetration test of a synchronisation middleware