What Automated Scanners Miss: Hand Testing Application Security