Web API attack demo