Testing Account Takeover (ATO) Vulnerabilities