vulnerability analysis for web applications