Conducting Security Testing for Web Applications