rest api penetration test