sqlmap: automatic SQL injection and database takeover tool