What does an attacker typically expect from a successful web application attack?