Analyzing web application threats to map out the attack surface