Real-World Bug Hunting: A Field Guide to Web Hacking