Black-box web app testing