This repository is a Chinese-language web security handbook, organized as a modular knowledge base rather than a deployable software product. It contains three knowledge layers: `vul/` (vulnerability principles), `exp/` (exploitation playbooks with raw payloads, bypasses, and version-specific CVE chains), and `penetration/` (pentest methodology from recon to post-exploitation). The content is intentionally machine-consumable: `AI-MAP.json` provides a topic→document index with aliases and keywords, `AI-WIKI.md` and `AGENTS.md` instruct AI coding agents on how to retrieve and maintain the material, and `README.md` serves as the human quick-reference matrix. The primary operational use is as a field manual for penetration testers, red teamers, and CTF players: it includes byte-exact request smuggling payloads, SSTI engine fingerprinting tables, Java/PHP/.NET deserialization gadget chains, SQL injection dialect differences, WAF bypass catalogs, and Active Directory/Kerberos attack notes. Although defensive topics such as authentication logic and crypto misuse are covered, the dominant voice is offensive. The code footprint is small: `scripts/check-consistency.py` validates the index and links in CI, and `penetration/logtamper.py` is a legacy Python 2 log-clearing utility. As a knowledge asset, the repo is well-crafted: documents follow a consistent template, cross-link extensively, and are backed by a consistency checker and GitHub Actions workflow. However, it is not a software library or service: there is no API, no package, and no runtime to deploy. Version-sensitive exploit content and some aging tool references should be validated before use. Offensive material is intended only for authorized security testing.