Wapiti: web-application vulnerability scanner