Attack vectors for web applications