System penetration testing