Towards Automated Penetration Testing for Cloud Applications