https://digitalab.org/2012/03/security-testing/