DAST vs. penetration testing: Key similarities and differences