Who mainly suffers from the actual payload of a web application attack?