Story Tag: web application vulnerability assessment