Penetration test of a new 2FA implementation within a web application