Application pen testing framework