Statistics for Developing Black Box Web Application Penetration Testing Methodology Using Comparative Criteria