Tactical web application penetration testing methodology

'.0A60.9*2/==960.A6<; #2;2A?.A6<;'2@A6;4 2A5<1<9<4F #5.@2"=2;&<B?02 ;3<?:.A6<;.A52?6;4 #5.@2."&&!' 6RDVDARHSDRRTBG@R 4DQUDQRMHEEMDS /DSBQ@ESBNL %NL@HMSNNKRBNL $DMSQ@KNORMDS $KDYMDS 3NASDWBNL 3DFDWHMENDWHEBFH OXSGNMFDNDCFDOXVVVS@QFDSBNLO@MXBNL 5NNK-NB@SHNM GSSOVVVDCFDRDBTQHSXBNLRNESFDNDCFDOX #5.@2/&2.?05;46;2)B9;2?./696AF$B6086A@ 42*%QA(NNFKDENQ42-*MIDBSHNM QTAXRPHCQALFPEHKDSXODIRO[EHKDSXOD@RO[EHKDSXOD@ROW[EHKDSXODOGO[ EHKDSXODOK[EHKDSXODBFH[EHKDSXODQA[EHKDSXODOX[EHKDSXODCNEHKDSXOD@ROW[ EHKDSXODOGO[EHKDSXODOK[EHKDSXODBFH[EHKDSXODQA[EHKDSXODOXHMTQKS@QFDSBNLO@MXBNL RHSDS@QFDSBNLO@MXBNLRQ GSSORPHCQTAXENQFDNQF (NNFKDENQFDMDQHB%@S@A@RDDQQNQR RHSDS@QFDSBNLO@MXBNL.HBQNRNES0-&%#1QNUHCDQENQ42-4DQUDQ RHSDS@QFDSBNLO@MXBNL.HBQNRNES+&5%@S@A@RD&MFHMD RHSDS@QFDSBNLO@MXBNL5XODLHRL@SBG RHSDS@QFDSBNLO@MXBNL:NTG@UD@MDQQNQHMXNTQ42-RXMS@W RHSDS@QFDSBNLO@MXBNL*MU@KHC42-RS@SDLDMSNQ+%#$ RHSDS@QFDSBNLO@MXBNL%NQHR%TJDDQQNQ RHSDS@QFDSBNLO@MXBNL0KD%A&WBDOSHNM RHSDS@QFDSBNLO@MXBNL+@RODQ&WBDOSHNM RHSDS@QFDSBNLO@MXBNL'@S@K&QQNQ RHSDS@QFDSBNLO@MXBNLRTOOKHDC@QFTLDMSHRMNS@U@KHC.X42- RHSDS@QFDSBNLO@MXBNLLXRPK? RHSDS@QFDSBNLO@MXBNL0%#$ RHSDS@QFDSBNLO@MXBNL+%#$ RHSDS@QFDSBNLO@MXBNL03" RHSDS@QFDSBNLO@MXBNL"%0%# 9444B@MOX(NNFKDENQ944 OXSGNM944RB@MOXRGSSOVVVS@QFDSBNLO@MXBNL@944VQHSD S@QFDSBNLO@MX?WWRSWSU GSSOVVVO@BJDSRSNQLRDBTQHSXNQF6/*9RB@MMDQR944RB@MOXSWS 4D@QBGWRRDCBNLENQSGDS@QFDSBNLO@MX (NNFKDENQFDMDQHB3'*R RHSDS@QFDSBNLO@MXBNLOGOEHKD RHSDS@QFDSBNLO@MXBNLOGOENKCDQ RHSDS@QFDSBNLO@MXBNLOGOO@SG RHSDS@QFDSBNLO@MXBNLOGORSXKD RHSDS@QFDSBNLO@MXBNLOGOSDLOK@SD RHSDS@QFDSBNLO@MXBNLOGO1)1?1"5) RHSDS@QFDSBNLO@MXBNLOGOCNB RHSDS@QFDSBNLO@MXBNLOGOCNBTLDMS RHSDS@QFDSBNLO@MXBNLOGOCNBTLDMS?QNNS RHSDS@QFDSBNLO@MXBNLOGOOF RHSDS@QFDSBNLO@MXBNLOGOOCE 4B@MENQJMNVM3'*R OXSGNMCNQJRB@MOXS@QFDSBNLO@MXBNLCNQJKHRSSWS GSSOVVVKD@QMRDBTQHSXNMKHMDBNLQEH?SDRSSWS GSSOVVVC@QJBCDBNLNSGDQRCNQJ4B@MOX (NNFKD%HFFHSX#HMF%HFFHSX GSSOVVVRS@BGKHTBNLHMCDWOGOQDRNTQBDRSNNKRFNNFKDG@BJHMFCHFFHSXOQNIDBS -NNJENQEHKDRSG@SFHUDTOFNNCHMENQL@SHNM QNANSRSWS "M@KXYDQNANSRSWSTRHMF(NNFKD8DAL@RSDQ5NNKR (NNFKDOQNUHCDR@M"M@KXYDQNANSRSWSETMBSHNM@RO@QSNEHSR(NNFKD 8DAL@RSDQ5NNKRVGHBGB@M@RRHRSVHSGSDRSHMF @MCSGDOQNBDCTQDHR@RENKKNVR 4HFMHMSN(NNFKD8DAL@RSDQ5NNKRVHSGXNTQ(NNFKD"BBNTMS 0MSGD%@RGAN@QCBKHBJSGD63-ENQSGDRHSDXNTV@MS $KHBJ5NNKR@MCSGDMBKHBJ"M@KXYDQNANSRSWS VHSGLDS@ROKNHS LRE@TWHKH@QXQNANSR?SWSQTM <>4B@MMDCNEGNRSRBNLOKDSD <><>QNANSRSWSYQ LRE@TWHKH@QXQNANSR?SWSQTM <><>QNANSRSWS@CLHMHRSQ@SNQB@BGDBNLONMDMSRHL@FDR HMBKTCDRHMRS@KK@SHNMK@MFT@FDKHAQ@QHDRLDCH@LNCTKDR OKTFHMR SDLOK@SDRSLOWLKQOB BQNRRCNL@HMWLK OGOHMENOGO 4HSDL@OWLK 4DMCANTMBDDL@HKSN@MNMDWHRSDMS@CCQDRR@SS@QFDSBNLO@MXBNLRNXNTB@M QD@CSGDGD@CDQHMENEQNLSGD.@HKDQ%@DLNM3DSTQMDC&L@HKQDRONMRD :NTB@MTRT@KKXFDSSGD*1@CCQDRRNEL@HKRDQUDQSGHRV@X@MCFDS@MHCD@NESGD HMSDQM@K*1Q@MFD #5.@2#9.A3<?:2A2?:6;.A6<; 2A2?:6;263A52A.?42A6@C6?AB.99F5<@A21 RGQVGNHRRGGSSOVVVS@QFDSBNLO@MXBNL GSSOO@BJDSRSNQLRDBTQHSXNQF6/*9RB@MMDQRQVGNHRRG 2A2?:6;263A52A.?42A6@9<.1/.9.;021 G@KADQCUGSSOVVVS@QFDSBNLO@MXBNL GSSOG@KADQCRTODQ@CCHSHUDBNL 2A2?:6;263A52A.?42A6@=?<A20A21/F.;#& NRRSLL@ECU1)551SGSSOVVVS@QFDSBNLO@MXBNLU GSSOVVVOTQDG@BJHMFBNL@ECCNVMKN@CROGO 2A2?:6;263A52A.?42A6@=?<A20A21/F.* V@EVEOXGSSOVVVS@QFDSBNLO@MXBNL GSSOBNCDFNNFKDBNLOV@EEHS 2A2?:6;2A52A.?42A=9.A3<?: @0ODQ@SHMF4XRSDL8HMCNVR-HMTW ML@OR70VVVS@QFDSBNLO@MXBNL A8DA4DQUDQ5XOD**4"O@BGD 'HQDENW4DQUDQ4OX GSSOR@CCNMRLNYHKK@NQFDM64EHQDENW@CCNM GSSOQHMSGGSSOVVVUTKMDQ@AKDRHSDBNLRRHFM@STQDRSWS GSSOMDSRPT@QDBNLGSSOQHMS GL@O GSSOTIDMHLTQJXQNBBNLGL@O 'HMFDQOQHMS3DEDQDMBD GSSOOQNIDBSRVDA@OORDBNQF'HMFDQOQHMSHMF B%@S@A@RD5XOD.442-.X42-0Q@BKD 'HMFDQOQHMS3DEDQDMBD GSSOOQNIDBSRVDA@OORDBNQF'HMFDQOQHMSHMF B4DQUDQ4HCD5DBGMNKNFX'HMFDQOQHMS"411)1+41 MI:CH>DC +:8=CDAD<N*:GK:G(A6I;DGB EA (:GA!#H8G>EI!:C:G>8JHJ6AANL:7H:GK:GHGJCC>C< DC,C>M 8<> 6C7:6CNH8G>EI>C<A6C<J6<: EN (NI=DC G7 )J7N 6HE 8I>K:*:GK:G(6<:H&>8GDHD;I##* 6HEM *(&>8GDHD;I'+ 6HBM *('+.:7*:GK:G E=E ("(H8G>EI!:C:G>8JHJ6AAN>CI:G;68:9L>I=E68=: 8;B DA9 JH>DC!:C:G>8JHJ6AAN>CI:G;68:9L>I= &>8GDHD;I##* 8;BA DA9 JH>DC&6G@JE%6C<J6<: CH; %DIJHDB>CD%DIJHDB>CDH:GK:G ?HE $6K6*:GK:G(6<:-6G>DJHEA6I;DGBH ?CEA $6K6.:7*I6GI >A:;DGB6II:9>C/&% 9D $6K6*IGJIH-6G>DJHEA6I;DGBH E=EE=EE=EE=IBA>C8 1)1&@RSDQ&FFR GSSORGHEKDSSNQFAKNFEDAOGOD@RSDQDFFR GSSOVVVOGOBNLOGO?D@RSDQ?DFFOGO "41'HMFDQOQHMSHMF GSSOLHBG@DKC@VNQFOQNIDBSR@RO@TCHSNQU C$KHDMS4HCD-@MFT@FD+@U@RBQHOS7#4BQHOS 7HDVVDARHSDRNTQBDBNCDSNCDSDQLHMDSGDRBQHOSHMFK@MFT@FDHMTRD 2A2?:6;263A52@6A2B@2@==960.A6<;#.42@<?B;0A6<;.9#.A5@ DW@CLHMDCHS6RDQIROURO@Q@LDSDQO@RRHMF@RHM@CLHMIRO @BSHNMDCHS6RDQ <<83<?@2?C2?:6@0<;364B?.A6<;@  60?<@<3A&#!'2/B446;4;./921 692;.:2@A.?AB=.@=E 8CC?BC1A75C?1C8BC1ACD?1B?G ''#AA.08%2>B2@A ,?1C8BC1ACD?1B?G++' )565A5A8CC?A560C1A75C >==53C9>=;>B5 >BCC1A75C ,B5A75=C$>I9;;13><?1C92;5$*  .9=4>FB%+ 'A17<1=>31385 >=C5=C#5=7C8 ><<1=4BC>?452D7 >==53C9>=3;>B54 >>:95*'*** &% (+(+"'$ $ #! *'%+0*5BB9>= 4<94;82@4A634;4? ''#)B9;2?./92%2@=<;@2 ++'&" *5AE5A$93A>B>6C * 1C5*1C!D;$+ /'>F5A54H*'%+ /B?%5C-5AB9>= 1385>=CA>;?A9E1C5 >=C5=C+H?5C5GC8C<;381AB5CDC6 >=C5=C#5=7C8 &" +)$5C8>4=12;54 ++'CC13:)5@D5BC =3FFFC1A75C3><?1=H3>< +)++' >BCFFFC1A75C3><?1=H3>< ++'-D;=5A12;5)5B?>=B5 ++'&" *5AE5A$93A>B>6C * 1C5+D5&3C$+ >==53C9>=3;>B5 >=C5=C+H?5<5BB1758CC? >=C5=C#5=7C8 +)++' >BCFFFC1A75C3><?1=H3><  .82@<:2:.;B.9?2>B2@A@3<?8;<D;C.961.;16;C.961?2@<B?02@.;1 612;A63F5<DA52@2?C2?5.;192@6A2E2A0 #5.@2BA<:.A60AA.08 &B?3.02 .==6;4 *2/&=612?6;4.;1CB9;2?./696AF612;A6360.A6<;D6A5.9<0.9=?<EF 4OHCDQSGDVDARHSDVHSG@KNB@KOQNWXKHJD1@QNRNQ#TQO4THSD *2/&=612?6;4.;1CB9;2?./696AF612;A6360.A6<;D6A5.;.0A6C2@0.;;2? 4B@MSGDVDARHSDVHSG@VDA@OOKHB@SHNMUTKMDQ@AHKHSXRB@MMDQRTBG@R $NLLDQBH@K "BTMDSHW "OORB@M 8DA*MRODBS /DSRO@QJDQ 0ODM4NTQBD V@E 8@OHSH /05& #DRTQDSNCNSGHRRSDOANSGVHSG@MCVHSGNTSKNFFHMFHMSNSGDRHSD .2.96;4D6A5.;"=2;&<B?02 & VG@SVDA BLRDWOKNQDQ QTAXVG@SVDA@GSSOVVVS@QFDSBNLO@MXBNL 5NNK-NB@SHNM GSSOVVVLNQMHMFRS@QRDBTQHSXBNLQDRD@QBGVG@SVDA ODQKBLRDWOKNQDQOKTQKGSSOVVVS@QFDSBNLO@MXBNLSXODINNLK@OKTFHMR ODQKBLRDWOKNQDQOKTQKGSSOVVVS@QFDSBNLO@MXBNLSXODINNLK@ ODQKBLRDWOKNQDQOKTQKGSSOVVVS@QFDSBNLO@MXBNLSXODINNLK@SGDLDR ODQKBLRDWOKNQDQOKTQKGSSOVVVS@QFDSBNLO@MXBNLSXODINNLK@NRUCA[FQDO NRUCA :NTB@MQDOK@BDINNLK@VHSG%QTO@K8NQCOQDRR.@LAN5GHRSNNKB@MPTDQX047%# ATS@M"1*JDXHRQDPTHQDC:NTB@MFDSSGD047%#"1*JDXEQNLGDQDGSSONRUCANQF @OH@ANTS 5NNK-NB@SHNM GSSOBLRDWOKNQDQFNNFKDBNCDBNLEHKDRBLRDWOKNQDQS@QAY 6R@FD3DEDQDMBD GSSOBNCDFNNFKDBNLOBLRDWOKNQDQVHJH6R@FD 6@0<C2?6112;<;A2;A 6RD@SNNKSG@SB@MKNNJENQGHCCDMBNMSDMSRTBG@R 8DAQSOK ODQK8DAQSOKGGSSOVVVS@QFDSBNLO@MXBNL GSSOO@BJDSRSNQLRDBTQHSXNQF6/*9BFHRB@MMDQR8DAQSOK %HQ#TRSDQ GSSORNTQBDENQFDMDSOQNIDBSRCHQATRSDQ #TQO*MSQTCDQ GSSOONQSRVHFFDQMDSRTHSDCNVMKN@CGSLK #5.@2 .;B.9AA.08&B?3.02 .==6;4 #5.@2.<<83<?A52/64CB9;2?./696A62@ #QNVRDSGDDMSHQDRHSDDUDQXRHMFKDO@FD@RJHMFXNTQRDKESGQDDPTDRSHNMR <2@A56@=.42<?@<:2A56;4<;A56@=.42A.98A<.1.A./.@2<?.;<A52? @F@A2: *ERNSDRSENQHMIDBSHNMUTKMDQ@AHKHSHDR42-91"5)-%"1DSB .;<?.;F<A52?D2/@6A2B@2?@22D5.AAF=2 *ERNSDRSENQ944NQRHLHK@Q@ATRDNESQTRSUTKMDQ@AHKHSHDR <2@A56@=.42<?@<:2A56;4<;A56@=.42?232?2;02.9<0.9<??2:<A23692 *ERNSDRSENQ-NB@K3DLNSD'HKDHMBKTCDR <2@56@=.42.==2.?A</2=.@@6;4B@2?6;=BAA<.&F@A2:3B;0A6<;<? =?<02@@6;4./9<08<30<12A5.A6@@B==96213?<:B@2?6;=BA *ERN@SSDLOSBNLL@MCHMIDBSHNM #5.@2/<<83<?A5292@@=<=B9.?CB9;2?./696A62@ ;32?2;023?<:#B/96@521<;A2;A 3DUHDVSGDQDRTKSRNEXNTQTRDQCHQDBSDCAQNVRHMF@MCA@RHBAQTSDENQBD DWDQBRHDR *CDMSHEXM@LHMFBNMUDMSHNMRTRDCDW*EXNTRDDRNLDSGHMFKHJD "CC%NBTLDMSIRO7HDV%NBTLDMSIROSGDMXNTRGNTKCKNNJENQSGHMFRKHJD &CHSCNBTLDMSIRO@MC3DLNUD%NBTLDMSIRO *CDMSHEXM@LHMFBNMUDMSHNMRENQRS@SHBBNMSDMS"MMT@K3DONQSOCE@MC "MMT@K3DONQSOCE LJCHQS@QFDSBNLO@MXCNBR OXSGNMLDS@FNNEHKOXCVVVS@QFDSBNLO@MXBNLKE@KKN S@QFDSBNLO@MXGSLKSS@QFDSBNLO@MXCNBR GSSOVVVDCFDRDBTQHSXBNLLDS@FNNEHKOGO 3DUHDV@KKBKHDMSRHCDBNCDENQBKTDRDWGSLKBNLLDMSRI@U@RBQHOS BNLLDMSRQDK@SDCSNOQNSDBSDCNQTMKHMJDCETMBSHNMR@MCGSLKCBENQLR VHSGCHR@AKDC46#.*5DKDLDMSR@ANTSGHCCDMRDQUDQRHCDBNMSDMS 4D@QBGENQSDLONQ@QXEHKDRDW%4?4SNQDEHKDOGO] %NVMKN@C@MCCDBNLOHKDI@U@@OOKDSRRGNBJV@UDEHKDR@BSHUD9BNMSQNKR %DBNLOHKDQR I@CDDWD I@U@CDBNLOHKDQ +NCD@MC+4V@S I@U@CDBNLOHKDQR /DS3DEKDBSNQ $CDBNLOHKDQ 'K@RL 48'AXSDBNCDCHR@RRDLAKDQ 4BQ@OD"QBGHUDNQF GSSOVVVLDS@ROKNHSBNLLNCTKDR@TWHKH@QXRB@MMDQGSSODMTL?V@XA@BJ 12;A63F962;A&612&20B?6AF<;A?<9@.;1.AA2:=AA</F=.@@A52: -NB@SD@KKHMRS@MBDRVGDQDGHCCDMENQLEHDKCRBNNJHDR@MC63- O@Q@LDSDQR@QD@OO@QDMSKXADHMFTRDCSNSQ@MRLHSC@S@UH@SGDBKHDMS "SSDLOSSNCDSDQLHMDNQFTDRRSGDOTQONRDSG@SSGDHSDLOK@XRHMSGD @OOKHB@SHNMRKNFHBA@RDCNMSGDBNMSDWSHMVGHBGHS@OOD@QR@MCNM BKTDRRTBG@RSGDO@Q@LDSDQRM@LD 6RHMF@KNB@KOQNWXLNCHEXSGDHSDLRU@KTDHMV@XRSG@S@QDQDKDU@MSSN HSROTQONRDHMSGD@OOKHB@SHNM"RBDQS@HMVGDSGDQSGD@OOKHB@SHNM ONRRDRRDR@QAHSQ@QXU@KTDRRTALHSSDCHMSGDO@Q@LDSDQ@MCVGDSGDQSGHR DWONRDRSGD@OOKHB@SHNMSN@MXUTKMDQ@AHKHSHDR %DS@HKR@ANTSCHR@AKHMF+@U@RBQHOSBKHDMSRHCDHMOTSU@KHC@SHNM 0UDQ@KK4SQ@SDFX %NVMKN@C@KNB@KBNOXNESGDO@FD@MCLNCHEXHSSNCHR@AKDBKHDMSRHCD BNMSQNKR  *MXNTQAQNVRDQQHFGSBKHBJNMSGDVDAO@FD 7HDV4NTQBD4@UD"R)@BJDCGSLK  /@UHF@SDSNSGD1045KHMD@MCLNCHEXSGDQDK@SHUDO@SGSN@M@ARNKTSDO@SG 5GHR V@XSGDO@FDJMNVRVGDQDSNFNVGDMXNTONRSEQNLXNTQKNB@KG@BJDCGSLKEHKD *ESGDVDARHSDHRB@KKDCUHBSHLBNLGDQDHRVG@SSGDHMOTSU@KHC@SHNMVNTKCKNNJKHJD #&'03& ;DGB >9;DGB5>9 B:I=D9EDHI 68I>DC68I>DCE=E DCHJ7B>I?6K6H8G>EIG:IJGCK6A>96I:;DGB5>9:B6>A >CEJI INE:I:MI >9:B6>A C6B::B6>A  >CEJI INE:HJ7B>I K6AJ:*J7B>I  ;DGB "'5&3 ;DGB >9;DGB5>9 B:I=D9EDHI 68I>DCLLLK>8I>B8DB68I>DCE=E DCHJ7B>I?6K6H8G>EIG:IJGCK6A>96I:;DGB5>9:B6>A >CEJI INE:I:MI >9:B6>A C6B::B6>A  >CEJI INE:HJ7B>I K6AJ:*J7B>I  ;DGB  3DEDQQHMFSNSGDDW@LOKDEQNL@ANUDRD@QBGENQSGDETMBSHNMB@KKDCU@KHC@SD *SVHKK OQNA@AKXKNNJRHLHK@QSNSGHR ;JC8I>DC K6A>96I:;DGB5>9:B6>A P K6G G:<  4106O52232106O52232106 O3PQ K6G 699G:HH  9D8JB:CI;DGBH1;DGB5>93:A:B:CIH1:B6>A3K6AJ: >;G:<I:HI699G:HH  ;6AH: P 6A:GI#CK6A>9B6>A99G:HH G:IJGC ;6AH: Q Q  0MBDSGDU@KHC@SHNMETMBSHNMG@RADDMHCDMSHEHDCQDLNUD@KKU@KHC@SHNMBNMSDMSRNSG@S SGDETMBSHNMNMKXQDSTQMRSQTD ;JC8I>DC K6A>96I:;DGB5>9:B6>A P QDSTQMSQTD Q  0ODMXNTQVDAAQNVRDQSNSGDKNB@KBNOXNEG@BJDCGSLK@MC@SSDLOS42-HMIDBSHNM "SSGHRONHMSOKD@RDQDEDQSNSGD42-HMIDBSHNMS@BSHBRKNB@SDCHM1G@RD 12;A63F@2@@6<;5.;196;4:205.;6@:.;1.AA2:=AA<./B@26A 4DRRHNM1QDCHBS@AHKHSX5DRSHMF BTQK*RGSSOVVVS@QFDSBNLO@MXBNL ODQKFDSBNNJHDOKGSSOVVVS@QFDSBNLO@MXBNL"41/&5?4DRRHNM*CSWS ODQKNARDRRHNMOKSWS GSSOVVVNODMK@ARNQFNARDRRHNMS@QFY NQ RSNLOXGSSOVVVS@QFDSBNLO@MXBNL GSSOKB@LSTEBNQDCTLOBWRSNLOXSFY NQ 8DA4B@Q@A GSSOVVVNV@RONQFHMCDWOGO$@SDFNQX08"41?8DA4B@Q@A?1QNIDBS%NVMKN@C %DBNCD7HDVRS@SD%@S@ K>:LHI6I:9:8D9:K:G7DH:JGAGSSOVVVS@QFDSBNLO@MXBNL GSSOK@ARONQSBTKKHRBNTJ@OOKHB@SHNMUHDVRS@SD GSSORNTQBDENQFDMDSOQNIDBSRUHDVRS@SD 7HDVRS@SD3DEDQDMBD GSSOLRCMLHBQNRNESBNLDMTRKHAQ@QXLR@ROW '2@A&&6=52?@ ODQKRRKBHOGDQBGDBJOKVVVS@QFDSBNLO@MXBNL GSSOVVVTMRODBHEHBBNLRRK NQ GSSOVVVENTMCRSNMDBNLTRQDRNTQBDROQNCCDRBRRKCHFFDQGSL NQ ODQKL@MXRRKOK GSSOVVVONQSBTKKHRRDBTQHSXBNLSNNKREQDDL@MXRRKS@QFY GSSOK@ARONQSBTKKHRBNTJ@OOKHB@SHNM.@MX44- NQ ML@ORBQHOSRRKUMRDOVVVS@QFDSBNLO@MXBNL GSSOML@ONQFMRDCNBRBQHOSRRRKUGSLK NQ DE:CHHAH58A>:CICD5IAHCD5HHA8DCC:8ILLLI6G<:I8DBE6CN8DB NQ /DRRTR"BTMDSHWNQRHLHK@QUTKMDQ@AHKHSXRB@MMDQ #5.@2 .;B.9AA.08@ .;B.9&$;720A6<;&# &&$&2?C2? *MSDFDQ@MC4SQHMF#@RDC*MIDBSHNM *MSDFDQ*MIDBSHNM GSSO<RHSD>O@FD@RO HCG@UHMF $NKTLM<$0-6.//".&>HRHMU@KHCHMSGDRDKDBSKHRSADB@TRDHSHRMNSBNMS@HMDCHM@M @FFQDF@SDETMBSHNM@MCSGDQDHRMN(3061#:BK@TRD 4SQHMF*MIDBSHNM GSSO<RHSD>O@FD@RO HCWG@UHMF $NKTLM<$0-6.//".&>HRHMU@KHCHMSGDRDKDBSKHRSADB@TRDHSHRMNSBNMS@HMDCHM@M @FFQDF@SDETMBSHNM@MCSGDQDHRMN(3061#:BK@TRD &MTLDQ@SHMF$NKTLM/@LDRVHSG)"7*/((3061#:$K@TRD 8GHKDVDQDNMSGDRTAIDBSNE)"7*/(HSHRONRRHAKDSNBNMSHMTDDMTLDQ@SHMF BNKTLMM@LDREQNLSGDBTQQDMSS@AKDSG@SHRADHMFPTDQHDCTRHMFSGHRRXMS@W GSSO<RHSD>O@FD@RO HCG@UHMF $NKTLM<S@AKDM@LD?$0-6.//".&?>HRHMU@KHCHMSGDRDKDBSKHRSADB@TRDHSHRMNS BNMS@HMDCHM@M@FFQDF@SDETMBSHNM@MCSGDQDHRMN(3061#:BK@TRD