Exploiting web application vulnerabilities