[Skunkworks] MYTHS WHEN PENTESTING IDENTITY MANAGEMENT SYSTEMS