A system for providing target application penetration testing, comprising: logic implemented by hardware logic circuitry configured to find at least one database injection vulnerability in said target application so as to gain access to data associated with said target application, wherein said target application contains at least one data entry point, and wherein finding said at least one database injection vulnerability includes using a set of predefined strings that contain at least one of commands and characters to populate each of said at least one data entry point of said target application and using a set of predefined answers associated to each predefined string; logic implemented by hardware logic circuitry configured to confirm said at least one database injection vulnerability and determine if said target application can be compromised by using the set of predefined strings to answer questions about the database injection vulnerability including one or more of: is there something indicative of vulnerability; what database management system is implemented; what SQL query is being implemented by the target Web application; and in what part of the SQL query does the input string go; can we extract some data; what is the number of columns in the database table that queries are being made to; what is the type of each column, wherein the answers to the one or more questions are determined by matching answers provided by the target application against the set of predetermined answers and their associated meanings, to verify whether said target application can be compromised; and logic implemented by hardware logic circuitry configured to compromise and analyze said application by extracting or manipulating data from a database associated with said application. logic implemented by hardware logic circuitry configured to find at least one database injection vulnerability in said target application so as to gain access to data associated with said target application, wherein said target application contains at least one data entry point, and wherein finding said at least one database injection vulnerability includes using a set of predefined strings that contain at least one of commands and characters to populate each of said at least one data entry point of said target application and using a set of predefined answers associated to each predefined string; logic implemented by hardware logic circuitry configured to confirm said at least one database injection vulnerability and determine if said target application can be compromised by using the set of predefined strings to answer questions about the database injection vulnerability including one or more of: is there something indicative of vulnerability; what database management system is implemented; what SQL query is being implemented by the target Web application; and in what part of the SQL query does the input string go; can we extract some data; what is the number of columns in the database table that queries are being made to; what is the type of each column, wherein the answers to the one or more questions are determined by matching answers provided by the target application against the set of predetermined answers and their associated meanings, to verify whether said target application can be compromised; and logic implemented by hardware logic circuitry configured to compromise and analyze said application by extracting or manipulating data from a database associated with said application.