steps to perform an app penetration test