How to make security testing of Web applications