Web application scanning using WMAP