Testing stupid vs smart attackers