Web Application Security Testing: What, How, and Why?