Penetration testing of mobile applications