Performing a black box penetration test