A black-box testing tool for identifying access control flaws within web applications