Pen testing can be a useful tool for gauging a Web application's ability to withstand an attack. However, if performed incorrectly, it is of little value and even worse, can create a false sense of security. In