Trying to simulate attack on SaaS Layer Cloud Computing ( Web application)

i want to make a simulation attack to prove that SaaS layer in Cloud Computing (Web Application) is vulnerable... How can i do the task?