Web app security exercises from the Web Application Hackers Handbook