diff --git a/resources/views/vulnerabilities/logs.blade.php b/resources/views/vulnerabilities/logs.blade.php
index 2963391..9751188 100644
--- a/resources/views/vulnerabilities/logs.blade.php
+++ b/resources/views/vulnerabilities/logs.blade.php
@@ -3,19 +3,48 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Hacker Panel - Stolen Data</title>
-    @vite(['resources/css/app.css'])
+    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
+    <title>Hacker Panel - C2 Server</title>
+    <script src="https://cdn.tailwindcss.com"></script>
 </head>
-<body class="bg-black text-green-500 font-mono p-10">
-    <div class="max-w-6xl mx-auto">
-        <h1 class="text-3xl font-bold text-red-600 mb-6">[!] Compromised Data Logs</h1>
+<body class="bg-black text-green-500 font-mono min-h-screen p-8 selection:bg-green-500 selection:text-black">
+    <div class="max-w-5xl mx-auto">
 
-        <div class="bg-gray-900 p-6 rounded border border-green-700 shadow-2xl">
-            <pre class="whitespace-pre-wrap">{{ $logs }}</pre>
+        <div class="border-b border-green-800 pb-4 mb-6 flex justify-between items-end">
+            <div>
+                <h1 class="text-4xl font-black text-red-600 tracking-tighter">[!] C2 SERVER LOGS</h1>
+                <p class="text-green-700 mt-2 text-sm">Listening for incoming stolen sessions...</p>
+            </div>
+            <div class="text-xs text-green-800">
+                STATUS: <span class="text-green-400 animate-pulse">ONLINE</span>
+            </div>
         </div>
 
-        <form action="{{ route('vulnerability.logs') }}" method="GET" class="mt-4">
-            <button class="bg-green-700 text-black px-4 py-2 rounded hover:bg-green-600">Refresh Logs</button>
+        <div class="bg-gray-950 p-6 rounded-lg border border-green-900 shadow-2xl relative">
+            <!-- Decorative Terminal Header -->
+            <div class="absolute top-0 left-0 w-full bg-green-900/20 px-4 py-1 text-xs text-green-600 flex gap-2">
+                <span>root@kali:~# cat /var/log/stolen_cookies.log</span>
+            </div>
+
+            <div class="mt-6 overflow-x-auto">
+                <pre class="whitespace-pre-wrap text-sm leading-relaxed">{{ $logs }}</pre>
+            </div>
+
+            @if($logs === 'هیچ دیتایی سرقت نشده است.')
+                <div class="text-center py-10 opacity-50">
+                    <svg class="w-12 h-12 mx-auto mb-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="1" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"></path></svg>
+                    NO DATA ACQUIRED YET
+                </div>
+            @endif
+        </div>
+
+        <form action="{{ route('vulnerability.logs') }}" method="GET" class="mt-6 flex gap-4">
+            <button class="bg-green-600/20 border border-green-500 text-green-400 px-6 py-2 rounded hover:bg-green-600 hover:text-black transition-all font-bold uppercase tracking-widest text-sm">
+                Refresh Logs
+            </button>
+            <a href="{{ route('home') }}" class="px-6 py-2 text-green-800 hover:text-green-500 transition uppercase tracking-widest text-sm flex items-center">
+                Return to Target
+            </a>
         </form>
     </div>
 </body>
diff --git a/resources/views/vulnerabilities/xss.blade.php b/resources/views/vulnerabilities/xss.blade.php
index caa322a..7574c7f 100644
--- a/resources/views/vulnerabilities/xss.blade.php
+++ b/resources/views/vulnerabilities/xss.blade.php
@@ -1,36 +1,48 @@
 <!DOCTYPE html>
-<html lang="en" dir="rtl">
+<html lang="fa" dir="rtl">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>XSS Lab - Browser Security</title>
-    @vite(['resources/css/app.css', 'resources/js/app.js'])
+    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
+    <title>آزمایشگاه XSS | Browser Security</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <style>body { font-family: Tahoma, sans-serif; }</style>
 </head>
-<body class="bg-gray-900 text-white font-sans p-10">
+<body class="bg-slate-900 text-slate-100 min-h-screen p-8">
     <div class="max-w-4xl mx-auto">
-        <h1 class="text-3xl font-bold text-red-500 mb-6 border-b border-red-500 pb-2">آزمایشگاه Reflected XSS</h1>
 
-        <div class="bg-gray-800 p-6 rounded-lg border border-gray-700 shadow-xl mb-6">
+        <div class="flex items-center gap-4 mb-8 border-b border-red-500/30 pb-4">
+            <div class="w-12 h-12 bg-red-500/10 rounded-xl flex items-center justify-center text-red-500">
+                <svg class="w-7 h-7" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 20l4-16m4 4l4 4-4 4M6 16l-4-4 4-4"></path></svg>
+            </div>
+            <div>
+                <h1 class="text-3xl font-bold text-red-500">آزمایشگاه Reflected XSS</h1>
+                <p class="text-slate-400 mt-1">تزریق کد مخرب و دور زدن سیاست‌های امنیتی مرورگر (CSP)</p>
+            </div>
+        </div>
+
+        <!-- فرم تزریق پی‌لود -->
+        <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-2xl mb-8">
             <form action="{{ route('vulnerability.xss') }}" method="GET">
-                <label for="payload" class="block text-sm font-medium text-gray-300 mb-2">پی‌لود مخرب (Payload) خود را اینجا وارد کنید:</label>
+                <label for="payload" class="block text-sm font-semibold text-slate-300 mb-3">پی‌لود مخرب (Payload) خود را اینجا وارد کنید:</label>
 
-                <div class="flex flex-col gap-4">
+                <div class="flex flex-col gap-5">
                     <textarea
                         name="payload"
                         id="payload"
-                        rows="3"
-                        class="w-full bg-gray-900 text-green-400 border border-gray-600 rounded-md p-3 focus:ring-red-500 focus:border-red-500 font-mono text-left"
+                        rows="4"
+                        class="w-full bg-slate-950 text-green-400 border border-slate-600 rounded-xl p-4 focus:ring-2 focus:ring-red-500 focus:border-red-500 font-mono text-left outline-none transition-all shadow-inner"
                         dir="ltr"
-                        placeholder="<script>alert(1)</script>"
-                    >{{ $payload ?? '' }}</textarea>
+                        placeholder="<script>alert('Hacked!');</script>"
+                    >{{ request('payload') ?? '' }}</textarea>
 
-                    <div class="flex items-center justify-between">
-                        <label class="flex items-center space-x-2 space-x-reverse cursor-pointer">
-                            <input type="checkbox" name="disable_csp" value="1" class="form-checkbox h-5 w-5 text-red-600 rounded bg-gray-700 border-gray-500" {{ request('disable_csp') ? 'checked' : '' }}>
-                            <span class="text-sm text-gray-400">غیرفعال کردن Content-Security-Policy (برای اجرای راحت‌تر اسکریپت)</span>
+                    <div class="flex flex-col md:flex-row items-center justify-between gap-4 bg-slate-900/50 p-4 rounded-xl border border-slate-700/50">
+                        <label class="flex items-center space-x-3 space-x-reverse cursor-pointer group">
+                            <input type="checkbox" name="disable_csp" value="1" class="form-checkbox h-5 w-5 text-red-500 rounded border-slate-500 bg-slate-800 focus:ring-red-500 focus:ring-offset-slate-900" {{ request('disable_csp') ? 'checked' : '' }}>
+                            <span class="text-sm text-slate-400 group-hover:text-slate-200 transition">غیرفعال کردن CSP (برای اجرای راحت‌تر اسکریپت روی مرورگرهای مدرن)</span>
                         </label>
 
-                        <button type="submit" class="bg-red-600 hover:bg-red-700 text-white font-bold py-2 px-6 rounded transition duration-200">
+                        <button type="submit" class="w-full md:w-auto bg-red-600 hover:bg-red-700 text-white font-bold py-2.5 px-8 rounded-lg transition duration-200 shadow-lg shadow-red-900/20">
                             اجرای حمله (Execute)
                         </button>
                     </div>
@@ -38,15 +50,20 @@ class="w-full bg-gray-900 text-green-400 border border-gray-600 rounded-md p-3 f
             </form>
         </div>
 
-        <div class="bg-gray-800 p-6 rounded-lg border border-gray-700 shadow-xl">
-            <h2 class="text-xl font-semibold mb-3 text-yellow-400">خروجی سرور (DOM Sink):</h2>
-            <p class="mb-4 text-sm text-gray-400">ورودی شما بدون فیلتر در کادر زیر رندر شده است:</p>
+        <!-- خروجی DOM -->
+        <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-xl relative overflow-hidden">
+            <div class="absolute top-0 right-0 w-2 h-full bg-yellow-500"></div>
+            <h2 class="text-xl font-bold mb-2 text-yellow-500 flex items-center gap-2">
+                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"></path></svg>
+                خروجی سرور (DOM Sink):
+            </h2>
+            <p class="mb-5 text-sm text-slate-400">مرورگر ورودی شما را در کادر زیر به عنوان بخشی از ساختار HTML رندر می‌کند:</p>
 
-            <div class="p-4 bg-gray-700 rounded border border-dashed border-yellow-500 text-yellow-200 min-h-[50px] text-left" dir="ltr">
-                {{-- آسیب‌پذیری ساختاریافته Blade --}}
-                {!! $payload ?? 'خروجی در اینجا نمایش داده می‌شود...' !!}
+            <div class="p-5 bg-slate-900 rounded-xl border border-dashed border-yellow-500/50 text-yellow-100 min-h-[80px] text-left font-mono break-words" dir="ltr">
+                {!! request('payload') ?? '<span class="text-slate-600">خروجی در اینجا نمایش داده می‌شود...</span>' !!}
             </div>
         </div>
+
     </div>
 </body>
 </html>
\ No newline at end of file
diff --git a/routes/web.php b/routes/web.php
index fdcc7b9..2ab5594 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Controllers\VulnerabilityController;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
 use App\Http\Controllers\UserController;
@@ -38,4 +39,17 @@
 // ==========================================
 Route::post('/update-email', [UserController::class, 'updateEmail'])
     ->withoutMiddleware([VerifyCsrfToken::class])
-    ->name('vulnerable.update.email');
\ No newline at end of file
+    ->name('vulnerable.update.email');
+
+
+// ==========================================
+// ۵. آزمایشگاه XSS و سرقت کوکی (Hacker Panel)
+// ==========================================
+// صفحه اصلی آزمایشگاه XSS
+Route::get('/xss', [VulnerabilityController::class, 'xss'])->name('vulnerability.xss');
+
+// روت مخفی هکر برای دریافت کوکی‌های سرقت شده (Stealer)
+Route::get('/stealer', [VulnerabilityController::class, 'logStolenData'])->name('vulnerability.stealer');
+
+// داشبورد هکر برای مشاهده دیتای سرقت شده
+Route::get('/hacker-panel', [VulnerabilityController::class, 'viewLogs'])->name('vulnerability.logs');
\ No newline at end of file
