Penetrating web application firewalls