Black-box web app configuration testing