Cloud penetration testing for SaaS