diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..63123fb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.DS_store
diff --git a/README.md b/README.md
index 1b4fd33..6d26521 100644
--- a/README.md
+++ b/README.md
@@ -16,29 +16,72 @@ Check out my [repos](https://github.com/qazbnm456) 🐾 or say *hi* on my [Twitt
## Menu
-- [Bypass](#bypass)
- - [CSP](#csp)
+- [Resource](#resource)
+ - [SQL Injection](#resource-sql-injection)
+ - [XML](#resource-xml)
+- [Evasion](#evasion)
+ - [CSP](#evasion-csp)
+- [Trick](#trick)
+ - [SQL Injection](#trick-sql-injection)
- [Tool](#tool)
- - [Code Generating](#code-generating)
- - [Fuzzing](#fuzzing)
+ - [Code Generating](#tool-code-generating)
+ - [Fuzzing](#tool-fuzzing)
+ - [Detecting](#tool-detecting)
+- [Blog](#blog)
+- [Miscellaneous](#miscellaneous)
+## Resource
-## Bypass
+
+### SQL Injection
+* [HQL for pentesters](http://blog.h3xstream.com/2014/02/hql-for-pentesters.html)
+
+
+### XML
+
+* [XML实体攻击 - 从内网探测到命令执行步步惊心](http://www.freebuf.com/video/49961.html), written by 张天琪.
+
+## Evasion
+
+
### CSP
-* [https://labs.detectify.com/2016/04/04/csp-bypassing-form-action-with-reflected-xss/](https://labs.detectify.com/2016/04/04/csp-bypassing-form-action-with-reflected-xss/), written by [Detectify Labs](https://labs.detectify.com/).
+* [CSP: bypassing form-action with reflected XSS](https://labs.detectify.com/2016/04/04/csp-bypassing-form-action-with-reflected-xss/), written by [Detectify Labs](https://labs.detectify.com/).
+
+## Trick
+
+
+### SQL Injection
+
+* [屌智硬之mysql不用逗号注入](http://www.jinglingshu.org/?p=2220), written by [jinglingshu](http://www.jinglingshu.org/?p=2220).
+* [见招拆招:绕过WAF继续SQL注入常用方法](http://www.freebuf.com/articles/web/36683.html), written by [mikey](http://www.freebuf.com/author/mikey).
## Tool
+
### Code Generating
* [VWGen](https://github.com/qazbnm456/VWGen) - Vulnerable Web applications Generator by [@qazbnm456](https://github.com/qazbnm456).
+
### Fuzzing
* [wfuzz](https://github.com/xmendez/wfuzz) - Web application bruteforcer by [@xmendez](https://github.com/xmendez).
+
+### Detecting
+
+* [sqlchop](https://github.com/chaitin/sqlchop/) - [DEPRECATED] A novel SQL injection detection engine built on top of SQL tokenizing and syntax analysis by [chaitin](http://chaitin.com).
+
+## Blog
+
+* [Broken Browser](https://www.brokenbrowser.com/) - Fun with Browser Vulnerabilities.
+
+## Miscellaneous
+
+* [如何正確的取得使用者 IP ?](http://devco.re/blog/2014/06/19/client-ip-detection/)
+
## License
[![CC0](http://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0/)