Web application penetration test of a toll system