diff --git a/CHANGELOG b/CHANGELOG
index 776c23e..1d4b73d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.7.0] - 2021-3-18
+### Added
+- Part of the code has been refactored to optimize the program structure
+- Added "PupilSearch" command
 
 ## [v1.6.5] - 2021-2-25
 ### Added
diff --git a/README.md b/README.md
index 58ddb12..880b51d 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,7 @@ kunyu init --apikey <your zoomeye key> --seebug <your seebug key>
 ```
 ![](./images/setinfo.png)
 
-You need to log in with ZoomEye credentials before using this tool for information collection.
+The first time you use it, you need to use the ZoomEye login credentials to use this tool to collect information.Currently, ZoomEye registered users are given 1w query quota every month, which is enough for daily work.
 
 ZoomEye access address: https://www.zoomeye.org/
 
@@ -95,14 +95,14 @@ Global commands:
         Seebug <query>                            Search Seebug vulnerability information
         set <option>                              Set Global arguments values
         view/views <ID>                           Look over banner row data information
-        SearchKeyWord                             Query sensitive information by keyword
+        PupilSearch <URL>/<ID>                    Example Query sensitive interfaces
         Pocsuite3                                 Invoke the pocsuite component
         ExportPath                                Returns the path of the output file
         CreateMap                                 Generate an IP distribution heat map
         AliveScan                                 The viability of the last retrieval
         clear                                     Clear the console screen
         help                                      Print Help info
-        exit                                      Exit KunYu & 
+        exit                                      Exit KunYu &
 ```
 
 **OPTIONS**
@@ -114,6 +114,12 @@ ZoomEye:
 	stype <v4/v6>					stype <v4/v6> Set to get data type IPV4 or IPV6
 	btype <host/web> 				Set the API interface for batch query
 	timeout <num>					Set the timeout period of Kunyu HTTP request
+	thread  						Set PupilSearch Thread Number(default is 10)
+	deep   							Set PupilSearch Search Deep(default is 2)
+	all  							PupilSearch Add All Url To Check List
+	fuzz   							PupilSearch Add Api To Check List
+    proxy  							PupilSearch HTTP Proxy
+	
 ```
 
 ## Use case introduction
@@ -196,11 +202,21 @@ Command format: **views ID**
 
 ![](./images/views.png)
 
-**Collection of Sensitive Information** 
+**PupilSearch Sensitive Information Collection**
+
+After Kunyu v1.7.0, the KeyWord command was removed and replaced with PupilSearch, which is the function of extracting sensitive data. Of course, it also supports the extraction of historical banner information through spatial mapping. For example, such as accesskey, the banner in historical data leaks sensitive data. Information, even if the service is changed now, but the AK/SK has not expired, it can still be used directly, understand everything, and support the extraction of sensitive information **(ID number, IP, JWT, API interface, appid, appkey, GithubAccessKey, default username \password, email, etc.)**.
+
+**Command format:**
+
+PupilSearch https://www.domain.com/
+
+PupilSearch ID (extract sensitive information from the banner returned by spatial mapping)
+
+![](./images/pupilsearch_1.png)
 
-After Kunyu v1.6.0, the acquisition of sensitive information in the banner has been added. Normally use the relevant grammar and set the number of pages. Kunyu will automatically collect the sensitive data in the banner information of the last query result, and then use the SearchKeyWord command to view the result . **Currently, testing will continue to focus on this feature point**. 
+![](./images/pupilsearch_2.png)
 
-![](./images/keyword.png)
+![](./images/pupilsearch_3.png)
 
 **System command execution** 
 
diff --git a/doc/README_CN.md b/doc/README_CN.md
index 4a3d8aa..e8b0774 100644
--- a/doc/README_CN.md
+++ b/doc/README_CN.md
@@ -56,7 +56,7 @@ kunyu init --apikey <your zoomeye key> --seebug <your seebug key>
 ```
 ![](../images/setinfo.png)
 
-初次使用需要通过ZoomEye登录凭证，才使用该工具进行信息收集。
+初次使用需要通过ZoomEye登录凭证，才使用该工具进行信息收集，目前ZoomEye注册用户每月赠送1w条查询额度，足够日常工作使用。
 
 **ZoomEye访问地址：https://www.zoomeye.org/**
 
@@ -92,14 +92,16 @@ Global commands:
         SearchDomain <Domain>                     Domain name associated/subdomain search
         EncodeHash <encryption> <query>           Encryption method interface 
         HostCrash <IP> <Domain>                   Host Header Scan hidden assets
+        show <config>/<rule>                      Show can set options or Kunyu config
         Seebug <query>                            Search Seebug vulnerability information
         set <option>                              Set Global arguments values
-        view/views <ID>                           Look over http/ssl row data information
-        SearchKeyWord                             Query sensitive information by keyword
+        view/views <ID>                           Look over banner row data information
+        PupilSearch <URL>/<ID>                    Example Query sensitive interfaces
         Pocsuite3                                 Invoke the pocsuite component
         ExportPath                                Returns the path of the output file
+        CreateMap                                 Generate an IP distribution heat map
+        AliveScan                                 The viability of the last retrieval
         clear                                     Clear the console screen
-        show                                      Show can set options
         help                                      Print Help info
         exit                                      Exit KunYu &
 ```
@@ -108,11 +110,16 @@ Global commands:
 
 ```
 ZoomEye:
-	page <Number>    查询返回页数(默认查询一页，每页20条数据)
-	dtype <0/1>      查询关联域名/子域名(设置0为查询关联域名，反之为子域名)
-	stype <v4/v6>	 设置获取数据类型IPV4或IPV6，默认为 ipv4,ipv6 全选
-	btype <host/web> 设置批量查询的API接口(默认为HOST)
-	timeout <num>	 设置Kunyu HTTP请求的超时时间
+		page <Number>    			查询返回页数(默认查询一页，每页20条数据)
+		dtype <0/1>      			查询关联域名/子域名(设置0为查询关联域名，反之为子域名)
+		stype <v4/v6>	 			设置获取数据类型IPV4或IPV6，默认为 ipv4,ipv6 全选
+		btype <host/web> 			设置批量查询的API接口(默认为HOST)
+		timeout <num>	 			设置Kunyu HTTP请求的超时时间
+		thread  		 			设置PupilSearch线程数量(默认为10)
+		deep   			 			设置PupilSearch递归深度(默认为2)
+		all  			 			PupilSearch Add All Url To Check List
+		fuzz   			 			PupilSearch Add Api To Check List
+    	proxy  			 			PupilSearch HTTP Proxy
 ```
 
 ## 使用案例
@@ -195,11 +202,21 @@ SearchIcon /root/favicon.ico
 
 ![](../images/views.png)
 
-**敏感信息收集**
+**PupilSearch敏感信息收集**
 
-在Kunyu v1.6.0版本后，增加了对banner中敏感信息的获取，平时使用正常使用相关语法，设置页数，Kunyu会自动收集上一次查询结果banner信息中的敏感数据，然后通过SearchKeyWord命令查看结果。**目前将持续测试关注该功能点**。
+在Kunyu v1.7.0版本后，移除了KeyWord命令替换为PupilSearch，就是提取敏感数据的功能，当然也支持通过空间测绘提取历史banner信息，举个例子像accesskey这种，历史数据中banner泄露了敏感信息，哪怕现在换了服务，但是AK/SK没有过期，依旧可以直接利用，懂得都懂，支持提取敏感信息**（身份证号、IP、JWT、API接口、appid、appkey、GithubAccessKey，default username\password、邮箱等）**。
 
-![](../images/keyword.png)
+命令格式：
+
+**PupilSearch https://www.domain.com/**
+
+**PupilSearch ID	(通过空间测绘返回的banner提取敏感信息)**
+
+![](../images/pupilsearch_1.png)
+
+![](../images/pupilsearch_2.png)
+
+![](../images/pupilsearch_3.png)
 
 **系统命令执行**
 
diff --git a/images/infos.png b/images/infos.png
index c24a8b4..2ab033d 100644
Binary files a/images/infos.png and b/images/infos.png differ
diff --git a/images/keyword.png b/images/keyword.png
deleted file mode 100644
index 315a350..0000000
Binary files a/images/keyword.png and /dev/null differ
diff --git a/images/pupilsearch_1.png b/images/pupilsearch_1.png
new file mode 100644
index 0000000..b331b1f
Binary files /dev/null and b/images/pupilsearch_1.png differ
diff --git a/images/pupilsearch_2.png b/images/pupilsearch_2.png
new file mode 100644
index 0000000..7e88222
Binary files /dev/null and b/images/pupilsearch_2.png differ
diff --git a/images/pupilsearch_3.png b/images/pupilsearch_3.png
new file mode 100644
index 0000000..7b25bfa
Binary files /dev/null and b/images/pupilsearch_3.png differ
diff --git a/images/searchico.png b/images/searchico.png
index 092334d..d2b2d5a 100644
Binary files a/images/searchico.png and b/images/searchico.png differ
diff --git a/images/setinfos.png b/images/setinfos.png
new file mode 100644
index 0000000..48d079e
Binary files /dev/null and b/images/setinfos.png differ
diff --git a/kunyu/config/__init__.py b/kunyu/config/__init__.py
index 04b0d11..012f221 100644
--- a/kunyu/config/__init__.py
+++ b/kunyu/config/__init__.py
@@ -1,9 +1,9 @@
 #!/usr/bin/env python
 # encoding: utf-8
-'''
+"""
 @author: 风起
 @contact: onlyzaliks@gmail.com
 @File: __init__.py
 @Time: 2021/6/15 17:50
-'''
+"""
 
diff --git a/kunyu/config/__version__.py b/kunyu/config/__version__.py
index 78ccb48..b603234 100644
--- a/kunyu/config/__version__.py
+++ b/kunyu/config/__version__.py
@@ -15,7 +15,7 @@
 __python_version__ = sys.version.split()[0]
 __platform__ = platform.platform()
 __url__ = "https://github.com/knownsec/Kunyu"
-__version__ = '1.6.5'
+__version__ = '1.7.0'
 __author__ = '风起'
 __Team__ = 'KnownSec 404 Team'
 __author_email__ = 'onlyzaliks@gmail.com'
diff --git a/kunyu/config/setting.py b/kunyu/config/setting.py
index c6b8a84..38deb40 100644
--- a/kunyu/config/setting.py
+++ b/kunyu/config/setting.py
@@ -52,6 +52,8 @@
     r'([a-zA-Z0-9][-_.a-zA-Z0-9]{0,61}[a-zA-Z0-9])).'\
     r'([a-zA-Z]{2,13}|[a-zA-Z0-9-]{2,30}.[a-zA-Z]{2,3})$'
 
+NUMBER_CHECK_REGEX = "^\+?[1-9][0-9]*$"
+
 UA = [
         "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50",
         "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50",
diff --git a/kunyu/core/PupilMain.py b/kunyu/core/PupilMain.py
new file mode 100644
index 0000000..dd000b4
--- /dev/null
+++ b/kunyu/core/PupilMain.py
@@ -0,0 +1,85 @@
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: export.py
+@Time: 2022/3/18 15:53
+"""
+
+import re
+import time
+
+from rich.console import Console
+
+from kunyu.lib import TrackUrl
+from kunyu.utils.log import logger
+import kunyu.lib.SerachData as SerachData
+from kunyu.lib.GlobalVariable import globalVariables as gbv
+
+console = Console(color_system="auto", record=True)
+
+class ParaInit:
+    def __init__(self, url, thread, trackdeep, mode, fuzz):
+        # There should be some / not less, for example,
+        # the target domain name is aaa.com/sso/, and it cannot be lazy as aaa.com/sso
+        self.url = url
+        gbv.url=url
+        gbv.thread = thread
+        gbv.apiresult = []
+        gbv.track = []  # add dynamically
+        # 0 means to search only for the current url without backtracking other urls,
+        # 1 means backtracking the url of the result obtained from the current url,
+        # 2 means to continue
+        self.trackdeep = trackdeep
+        gbv.urlresult = []
+        # Whether to traverse all URLs found. Choose carefully, it's a bit long
+        gbv.searchany = mode
+        # Whether to add the interface to the backtracking queue
+        gbv.fuzz = fuzz
+        gbv.trackhistory = []  # Record already processed urls to prevent repeated queries
+        gbv.Sensitiveinformation = {"Jwt": [], "Ip": [], "Email": [], "ChinaIdCard": [], "AccessKey": [],
+                                    "SecretKey": [], "AppId": [], "UserName": [], "PassWord": [],
+                                    "SSHKey": [], "RSAKey": [], "GithubAccessKey": []}
+        # Backtracking depth
+        gbv.trackdeep = 0  # current depth
+        gbv.deep = trackdeep  # allow depth
+        gbv.track.append([])
+        gbv.track[0].append(url)
+
+    def url_handler(self):
+        # Fill in the url, the url cannot be www.aaa.com, it needs to be www.aaa.com/,
+        # because the data of the first and last / will be deleted later for js concatenation.
+        # If it is not added, the host will be removed.
+        pattern = re.compile('/')
+        if len(re.findall(pattern, self.url[:])) == 2:
+            self.url = self.url + "/"
+
+    def main(self):
+        self.url_handler()
+        return self.url, self.trackdeep
+
+
+class Pupil:
+    def __init__(self) -> None:
+        console.log("PupilSearch KeyWord Start:", style="green")
+
+    def main(self, proxy):
+        start_time = time.time()
+        gbv.proxy = proxy
+        TrackUrl.Track().main()
+        logger.info("PupilSearch Total time:{}".format(time.time() - start_time))
+
+    def response_main(self, raw_data):
+        start_time = time.time()
+        SerachData.DataHandler("http://www.kunyu.com/", raw_data).main()
+        if gbv.apiresult:
+            logger.warning("Retrieving results API:")
+            console.print(list(set(gbv.apiresult)))
+            print("")
+        if gbv.urlresult:
+            logger.warning("Retrieving results URL:")
+            console.print((list(set(gbv.urlresult))))
+            print("")
+        if gbv.Sensitiveinformation:
+            logger.warning("Retrieving results KeyWord:")
+            console.print(gbv.Sensitiveinformation)
+        logger.info("PupilSearch Total time:{}".format(time.time() - start_time))
diff --git a/kunyu/core/__init__.py b/kunyu/core/__init__.py
index 94c67b7..9fba022 100644
--- a/kunyu/core/__init__.py
+++ b/kunyu/core/__init__.py
@@ -7,7 +7,6 @@
 @Time: 2021/6/21 16:26
 '''
 
-
 import os
 import sys
 import json
diff --git a/kunyu/core/console.py b/kunyu/core/console.py
index c4fb8f0..c796173 100644
--- a/kunyu/core/console.py
+++ b/kunyu/core/console.py
@@ -6,7 +6,7 @@
 @File: console.py
 @Time: 2021/7/19 22:35
 '''
-import logging
+
 import os
 import sys
 import platform
@@ -14,7 +14,6 @@
 from pathlib import Path
 
 from colorama import init
-from rich.table import Table
 from rich.console import Console
 
 from kunyu.config import setting
@@ -22,6 +21,7 @@
 from kunyu.core.rule import YamlRule
 from kunyu.lib.export import createdir
 from kunyu.core.zoomeye import ZoomEye
+from kunyu.utils.tables import DisposeTables
 from kunyu.utils import readineng as readline
 from kunyu.config.__version__ import __introduction__
 from kunyu.config.setting import COMMAND_INFO, OS_SYSTEM, RULE_FILE_PATH, RULE_INFO
@@ -49,13 +49,93 @@ def auto_completion(completion=None, console=None):
     readline.set_completer(console)
     readline.parse_and_bind("tab: complete")
 
+class CommandCompleter:
+    module = "ZoomEye"
+    command, line = None, None
+    command_func_params = ["setter", "getter", "clear", "exit", "help", "set", "exportpath"]
+
+    def __init__(self) -> None:
+        self.module = CommandCompleter.module
+        self.line = CommandCompleter.line
+
+    def command_setter(self, line) -> bool:
+        """"
+        :line set options
+        """
+        args, _, number = line.strip().partition("=")
+        args, number = args.strip(), number.strip()
+        if hasattr(eval(self.module), args):
+            setattr(eval(self.module), args, number)
+        return True
+
+    def command_getter(self, line):
+        """"
+        :return options value
+        """
+        return getattr(eval(self.module), line)
+
+    def show_rule(*args, **kwargs) -> bool:
+        tables = DisposeTables().result_table(RULE_INFO)
+        # Display fingerprint file information
+        for res in setting.RULE_PARMAS:
+            tables.add_row(
+                str(res["KXID"]), str(res["author"]), str(res["kx_name"]),str(res["description"]),
+                str(res["kx_query"]), str(res["createDate"]), str(res["source"])
+            )
+        console.log("Finger Rule Info:", style="green")
+        console.print(tables)
+        return True
+
+    def show_config(*args, **kwargs) -> bool:
+        # Display configuration file information
+        config_file_path = os.path.expanduser('~/')+".kunyu.ini"
+        with open(config_file_path) as file:
+            logger.info(file.read())
+        return True
+
+    def show(self):
+        tables = DisposeTables().result_table(COMMAND_INFO)
+        command_info = [
+            ["page", self.command_getter("page"), "Set Search Page"],
+            ["dtype", self.command_getter("dtype"), "Set Associated/Subdomain Search Schema"],
+            ["stype", self.command_getter("stype"), "Set data type IPV4/IPV6 (option v4/v6)"],
+            ["btype", self.command_getter("btype"), "Set BatchFile Search Schema"],
+            ["timeout", self.command_getter("timeout"), "Set HTTP Requests Timeout"],
+            ["thread", self.command_getter("thread"), "Set PupilSearch Thread Number"],
+            ["deep", self.command_getter("deep"), "Set PupilSearch Search Deep"],
+            ["all", self.command_getter("all"), "PupilSearch Add All Url To Check List"],
+            ["fuzz", self.command_getter("fuzz"), "PupilSearch Add Api To Check List"],
+            ["proxy", self.command_getter("proxy"), "PupilSearch HTTP Proxy"]
+        ]
+        for info in command_info:
+            tables.add_row(
+                str(info[0]), str(info[1]), str(info[2])
+            )
+        console.log("Global Command Info:", style="green")
+        console.print(tables)
+
+    def command_clear(*args, **kwargs):
+        subprocess.call(cmd, shell=True)
+
+    def command_exit(*args, **kwargs):
+        raise KeyboardInterrupt
+
+    def command_help(self):
+        console.print(eval(self.module).help)
+
+    def command_set(self):
+        return CommandCompleter.command_setter(self, CommandCompleter.line)
+
+    def command_exportpath(*args, **kwargs):
+        logger.info(setting.OUTPUT_PATH)
+
 
 class BaseInterpreter(object):
     global_help = ""
     OUTPUT_PATH = None
 
     def __init__(self):
-        self.module = "ZoomEye"
+        self.module = CommandCompleter.module
         self.complet = eval(self.module).Command_Info
         self.setup()
         # Create output directory
@@ -74,23 +154,6 @@ def parse_line(self, line):
         command, _, args = line.strip().partition(" ")
         return command, args.strip()
 
-    def setter(self, line):
-        """"
-        :line set options
-        """
-        args, _, number = line.strip().partition("=")
-        args, number = args.strip(), number.strip()
-        if hasattr(eval(self.module), args):
-            setattr(eval(self.module), args, number)
-
-        return True
-
-    def getter(self, line):
-        """"
-        :return options value
-        """
-        return getattr(eval(self.module), line)
-
     @property
     def prompt(self):
         """ Returns prompt string """
@@ -136,79 +199,25 @@ def raw_command_completer(self, text):
     def default_completer(self, *ignored):
         return []
 
-    def show_rule(self):
-        tables = Table(show_header=True, style="bold")
-        for cloumn in RULE_INFO:
-            tables.add_column(
-                cloumn, justify="center", overflow="ignore"
-            )
-        # Display fingerprint file information
-        for res in setting.RULE_PARMAS:
-            tables.add_row(
-                str(res["KXID"]), str(res["author"]), str(res["kx_name"]),str(res["description"]),
-                str(res["kx_query"]), str(res["createDate"]), str(res["source"])
-            )
-        console.log("Finger Rule Info:", style="green")
-        console.print(tables)
-        return True
-
-    def show_config(self):
-        # Display configuration file information
-        config_file_path = os.path.expanduser('~/')+".kunyu.ini"
-        with open(config_file_path) as file:
-            logger.info(file.read())
-        return True
-
     def auxiliary(self, command, line=None):
         """"Set how to handle basic commands
         :return True/False
         """
-        if command == "clear":
-            subprocess.call(cmd, shell=True)
-            return True
-        elif command == "exit":
-            raise KeyboardInterrupt
-
-        elif command == "help":
-            console.print(eval(self.module).help)
-            return True
-        elif command == "set":
-            return self.setter(line)
-
+        CommandCompleter.line = line
         # show Global Command Info
-        elif command == "show":
-            if line == "rule":
-                return self.show_rule()
-            elif line == "config":
-                return self.show_config()
-            table = Table(show_header=True, style="bold")
-            for cloumn in COMMAND_INFO:
-                table.add_column(
-                    cloumn, justify="center", overflow="fold"
-                )
-            command_info = [["page", self.getter("page"),"Set Search Page"],
-                            ["dtype", self.getter("dtype"), "Set Associated/Subdomain Search Schema"],
-                            ["stype", self.getter("stype"), "Set data type IPV4/IPV6 (option v4/v6)"],
-                            ["btype", self.getter("btype"), "Set BatchFile Search Schema"],
-                            ["timeout", self.getter("timeout"), "Set HTTP Requests Timeout"]]
-            for info in command_info:
-                table.add_row(
-                    str(info[0]), str(info[1]), str(info[2])
-                )
-            console.log("Global Command Info:", style="green")
-            console.print(table)
+        if command == "show":
+            if line in ["rule", "config"]:
+                return eval("CommandCompleter.{}_{}()".format(command, line))
+            CommandCompleter().show()
             return True
-        elif command == "exportpath":
-            # Return Export Path
-            logger.info(setting.OUTPUT_PATH)
+
+        elif command in CommandCompleter.command_func_params:
+            eval("CommandCompleter.command_{}(self)".format(command))
             return True
 
         elif command in OS_SYSTEM:
-            try:
-                command_os = "{} {}".format(command, line)
-                os.system(command_os)
-            except KeyboardInterrupt:
-                print("")
+            command_os = "{} {}".format(command, line)
+            os.system(command_os)
             return True
 
         return False
@@ -223,11 +232,11 @@ def start(self):
                 if self.auxiliary(command, args) or not command:
                     continue
                 command_handler = self.get_command_handler(command)
-                command_handler(args)
+                try:
+                    command_handler(args)
+                except KeyboardInterrupt:
+                    print("")
 
-            except EOFError:
-                logger.info("kunyu Console mode stopped")
-                break
             except KeyboardInterrupt:
                 logger.info("kunyu Console mode stopped")
                 try:
@@ -237,7 +246,7 @@ def start(self):
                 sys.exit(0)
 
             except Exception as err:
-                # console.print(err)
+                console.print(err)
                 continue
 
 
diff --git a/kunyu/core/crash.py b/kunyu/core/crash.py
index df15900..fb2078b 100644
--- a/kunyu/core/crash.py
+++ b/kunyu/core/crash.py
@@ -76,8 +76,7 @@ def request_get():
                 self.params["page"] = str(i + 1)
                 result = request_get()
                 for num in range(len(result["list"])):
-                    data = convert(result["list"][num])
-                    domain_list.append(data.name)
+                    domain_list.append(convert(result["list"][num]).name)
             # Remove duplicate domain names
             domain_list = list(set(domain_list))
             console.log("Host Header Scan Domain Total: ", len(domain_list), style="green")
@@ -143,17 +142,14 @@ def host_scan(self, search, ip):
             :param search: Ways to obtain domain names
             :param ip: IP address to be collided
         """
-        resp, crash_list = [], []
-        tmp_list = []
-        status = False
+        resp, crash_list, status = [], [], False
         if SERVERLESS_API != "None": status = True
         # http and https protocol collision
         protocol = ['http://{}/', 'https://{}/']
         self.params["q"] = search
         domain_list = self._get_file(search)
-        url = self._get_ip_file(ip)
         for server in protocol:
-            for ip_address in url:
+            for ip_address in self._get_ip_file(ip):
                 urls = server.format(ip_address)
                 resp_url = SERVERLESS_API if status else urls
                 for domain in domain_list:
diff --git a/kunyu/core/keyword.py b/kunyu/core/keyword.py
deleted file mode 100644
index d1f42d7..0000000
--- a/kunyu/core/keyword.py
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-'''
-@author: 风起
-@contact: onlyzaliks@gmail.com
-@File: keyword.py
-@Time: 2021/11/12 9:23
-'''
-import re
-
-from rich.table import Table
-from rich.console import Console
-
-console = Console(color_system="auto", record=True)
-EMAIL_REGEX = r"([\w-]+(\.[\w-]+)*@[\w-]+(\.[\w-]+)+)"
-PHONE_REGEX = r"^1[358]\d{9}$|^147\d{8}$|^179\d{8}$"
-DOMAIN_REGEX = r'<a\s*href=\"(.*?)\"'
-IDENTITY_REGEX = r"[1-9]\d{5}(?:18|19|(?:[23]\d))\d{2}(?:(?:0[1-9])|(?:10|11|12))(?:(?:[0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]"
-IP_ADDRESS_REGEX = r"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"
-DOMAIN_CHECK_REGEX = r'<a\s*href=\"(.*?)\"'
-
-
-class SearchKeyWord:
-    def __init__(self):
-        self.sensitive_params = []
-
-    def __check_email(self, banner):
-        email_mod = re.compile(EMAIL_REGEX)
-        items = email_mod.findall(banner)
-        return items
-
-    # Check whether it is valid phone number
-    def __check_phone(self, banner):
-        phone_mod = re.compile(PHONE_REGEX)
-        items = phone_mod.findall(banner)
-        return items
-
-    """
-        # Check whether it is valid domain address
-        def __check_domain_address(self, banner):
-            domain_mod = re.compile(DOMAIN_REGEX)
-            items = domain_mod.findall(banner)
-            return items
-    """
-
-    # Check whether it is valid ip address
-    def __check_ip_address(self, banner):
-        ip_mod = re.compile(IP_ADDRESS_REGEX)
-        items = ip_mod.findall(banner)
-        return items
-
-    """
-        # Check whether it is valid identity card
-        def __check_identity(self, banner):
-            identity_mod = re.compile(IDENTITY_REGEX)
-            items = identity_mod.findall(banner)
-            return items
-    """
-
-    def get_keyword_sensitive(self, banner):
-        # Obtain email information in the banner
-        for email in self.__check_email(banner):
-            self.sensitive_params.append(email[0])
-
-        # Obtain phone number information in the banner
-        for phone in self.__check_phone(banner):
-            self.sensitive_params.append(phone[0])
-
-        """ 
-            # Obtain domain information in the banner
-            for domain in self.__check_domain_address(banner):
-                self.sensitive_params.append(domain[0])
-
-            # Obtain identity card information in the banner
-            for identity in self.__check_identity(banner):
-                self.sensitive_params.append(identity[0])
-        """
-
-        # Obtain ip address information in the banner
-        for ip in self.__check_ip_address(banner):
-            self.sensitive_params.append(ip)
-
-        if self.sensitive_params:
-            return self.sensitive_params
diff --git a/kunyu/core/seebug.py b/kunyu/core/seebug.py
index b6d5cbb..24b9023 100644
--- a/kunyu/core/seebug.py
+++ b/kunyu/core/seebug.py
@@ -44,9 +44,8 @@ def search(cls, search):
             cls.param = {
                 "app_name": search
             }
-            login_url = "%s?%s" % (SEARCH_API, urlencode(cls.param))
             resp = requests.get(
-                login_url,
+                "%s?%s" % (SEARCH_API, urlencode(cls.param)),
                 headers=cls.headers,
                 verify=False
             )
diff --git a/kunyu/core/zoomeye.py b/kunyu/core/zoomeye.py
index f52bba2..d306949 100644
--- a/kunyu/core/zoomeye.py
+++ b/kunyu/core/zoomeye.py
@@ -16,30 +16,30 @@
 import requests
 import platform
 from rich.live import Live
-from rich.table import Table
 from rich.console import Console
 
 try:
     import pocsuite3
 except ImportError:
     sys.path.append(os.path.abspath(os.path.join(os.path.dirname(os.path.dirname(__file__)), os.path.pardir)))
-from pocsuite3.cli import check_environment, module_path
 from pocsuite3 import set_paths
+from pocsuite3.cli import check_environment, module_path
 from pocsuite3.lib.core.interpreter import PocsuiteInterpreter
 from pocsuite3.lib.core.option import init_options
 
+from kunyu.core import conf
 from kunyu.config import setting
-from kunyu.core.scanalive import Scan_Alive_Ip
 import kunyu.lib.encode as encode
+from kunyu.core.seebug import Seebug
+from kunyu.core.crash import HostScan
+from kunyu.lib.export import export_xls
+from kunyu.lib.batchfile import get_file
+from kunyu.utils.tables import DisposeTables
+from kunyu.core.scanalive import Scan_Alive_Ip
 from kunyu.config.setting import UA, USER_INFO_API, HOST_SEARCH_API, WEB_SEARCH_API, DOMAIN_SEARCH_API, HOST_SCAN_INFO, \
     SEMSITIVE_INFO, RULE_PARMAS, ALIVE_SCAN_INFO
+from kunyu.core.PupilMain import Pupil, ParaInit
 from kunyu.core.createmap import create_data_map
-from kunyu.lib.export import export_xls
-from kunyu.lib.batchfile import get_file
-from kunyu.core.crash import HostScan
-from kunyu.core.keyword import SearchKeyWord
-from kunyu.core import conf
-from kunyu.core.seebug import Seebug
 from kunyu.utils.log import logger, logger_console
 from kunyu.config.__version__ import __help__, init
 
@@ -78,8 +78,6 @@ def wrapper(*args, **kwargs):
                 logger.warning(err)
             except requests.exceptions.ConnectionError:
                 logger.error("Network timeout")
-            except KeyboardInterrupt:
-                return
             return req_list
 
         return wrapper
@@ -184,6 +182,7 @@ class ZoomEye:
     ssl_data_params, raw_data_params, sensitive_params, scatter_params, scan_alive_params = {}, {}, [], [], []
     page, dtype, timeout = 1, 0, 30
     stype, btype = "v4", "host"
+    thread, deep, all, fuzz, proxy = 10, 2, False, False, False
 
     # Global commands List
     help = """Global commands:
@@ -200,7 +199,7 @@ class ZoomEye:
         Seebug <query>                            Search Seebug vulnerability information
         set <option>                              Set Global arguments values
         view/views <ID>                           Look over banner row data information
-        SearchKeyWord                             Query sensitive information by keyword
+        PupilSearch <URL>/<ID>                    Example Query sensitive interfaces and information
         Pocsuite3                                 Invoke the pocsuite component
         ExportPath                                Returns the path of the output file
         CreateMap                                 Generate an IP distribution heat map
@@ -212,7 +211,7 @@ class ZoomEye:
     # ZoomEye Command List
     Command_Info = ["help", "info", "set", "Seebug", "SearchWeb", "SearchHost", "SearchIcon", "HostCrash",
                     "SearchBatch", "SearchCert", "SearchDomain", "EncodeHash", "Pocsuite3", "ExportPath",
-                    "show", "clear", "view", "DirectoryCrash", "AliveScan","views", "SearchKeyWord", "CreateMap", "exit"]
+                    "show", "clear", "view", "DirectoryCrash", "AliveScan","views", "PupilSearch", "CreateMap", "exit"]
 
     def __init__(self):
         self.fields_tables = None
@@ -233,7 +232,6 @@ def __command_search(self, search, types="host"):
         """
         self.__params_clear(self)
         GlobalVar.set_timeout_resp(self.timeout)
-        table = Table(show_header=True, style="bold")
         global total, api_url, result, FIELDS, export_host
         result_type = "matches"
         total, num = 0, 0
@@ -248,14 +246,7 @@ def __command_search(self, search, types="host"):
             params['q'], params['type'] = search, self.dtype
             api_url, FIELDS = DOMAIN_SEARCH_API, self.ZOOMEYE_FIELDS_DOMAIN
 
-        try:
-            for cloumn in FIELDS:
-                table.add_column(
-                    cloumn, justify="center", overflow=overflow
-                )
-        except Exception:
-            return logger.warning("Please enter the correct field")
-
+        table = DisposeTables().result_table(FIELDS, overflow)
         # Get data information
         for result in _dork_search(api_url, search, self.page, self.stype):
             try:
@@ -268,8 +259,13 @@ def __command_search(self, search, types="host"):
                     if api_url == HOST_SEARCH_API:
                         if data.portinfo.title:
                             title = data.portinfo.title[0]
+
                         try:
                             data_isp = data.geoinfo.isp
+                            # Reset the <raw Data Params> element
+                            self.raw_data_params[num] = data.portinfo.banner
+                            # Reset the <ssl raw Data Params> element
+                            self.ssl_data_params[num] = data.ssl
                         except:
                             pass
 
@@ -293,66 +289,43 @@ def __command_search(self, search, types="host"):
                             "lng": str(lon), "lat": str(lat), "ip": data.ip
                         })
 
-                        # Reset the <raw Data Params> element
-                        self.raw_data_params[num] = data.portinfo.banner
-
-                        # Reset the <ssl raw Data Params> element
-                        try:
-                            ssl_raw_data = data.ssl
-                            self.ssl_data_params[num] = ssl_raw_data
-                        except:
-                            pass
-
                         self.scan_alive_params.append({
                                 "ip":data.ip,
                                 "port":str(data.portinfo.port)
                         })
 
-                        # Get the sensitive information in the banner
-                        sensitive = SearchKeyWord().get_keyword_sensitive(data.portinfo.banner)
-                        if sensitive: self.sensitive_params.append(sensitive)
-
                     elif api_url == WEB_SEARCH_API:
                         # Because of the problem of returning the default value of the field
                         if data.webapp:
-                            webapp = self.convert(data.webapp[0])
-                            webapp_name = webapp.name
+                            webapp_name = self.convert(data.webapp[0]).name
                         if data.server:
-                            server = self.convert(data.server[0])
-                            server_name = server.name
+                            server_name = self.convert(data.server[0]).name
                         if data.db:
-                            db = self.convert(data.db[0])
-                            db_name = db.name
+                            db_name = self.convert(data.db[0]).name
                         if data.language:
                             language = data.language[0]
                         if data.system:
-                            system = self.convert(data.system[0])
-                            system_os = system.name
+                            system_os = self.convert(data.system[0]).name
 
                         # Set the output field
-                        table.add_row(str(num), data.ip[0], str(data.site), str(data.title),
-                                      str(system_os), str(webapp_name), str(db_name),
-                                      str(language), str(server_name), str(data.timestamp).split("T")[0])
+                        table.add_row(
+                            str(num), data.ip[0], str(data.site), str(data.title),
+                            str(system_os), str(webapp_name), str(db_name),
+                            str(language), str(server_name), str(data.timestamp).split("T")[0]
+                        )
 
                         # Set the exported fields
                         export_host = [str(num), data.ip[0], str(data.site), str(data.title),
                                        str(system_os), str(webapp_name), str(db_name),
                                        str(language), str(server_name), str(data.timestamp).split("T")[0]]
 
-                        # Reset the <raw Data Params> element
-                        self.raw_data_params[num] = data.raw_data
-
-                        # Reset the <ssl raw Data Params> element
                         try:
-                            ssl_raw_data = data.ssl
-                            self.ssl_data_params[num] = ssl_raw_data
+                            # Reset the <raw Data Params> element
+                            self.raw_data_params[num] = data.raw_data
+                            self.ssl_data_params[num] = data.ssl
                         except:
                             pass
 
-                        # Get the sensitive information in the banner
-                        sensitive = SearchKeyWord().get_keyword_sensitive(data.raw_data)
-                        if sensitive: self.sensitive_params.append(sensitive)
-
                     elif types == "domain":
                         # Set the output field
                         table.add_row(
@@ -364,7 +337,8 @@ def __command_search(self, search, types="host"):
 
                 if export_list:
                     export_xls(export_list, FIELDS)
-            except Exception:
+            except Exception as err:
+                logger.error(err)
                 continue
 
         # Check if the result set is empty
@@ -380,18 +354,16 @@ def __command_search(self, search, types="host"):
     @classmethod
     def command_info(cls, *args):
         """ return user info"""
-        table = Table(show_header=True, style="bold")
         info = cls.convert(_user_info()[0])
         # Calculate the total quota for the month
         search_quota = int(info.quota_info.remain_free_quota) + int(info.quota_info.remain_pay_quota)
-        for column in cls.ZOOMEYE_FIELDS_INFO:
-            table.add_column(
-                column, justify="center", overflow=overflow
-            )
+        table = DisposeTables().result_table(cls.ZOOMEYE_FIELDS_INFO, overflow)
         info.user_info.expired_at = None if info.user_info.expired_at == "" else info.user_info.expired_at
         console.log("User Information:", style="green")
-        table.add_row(str(info.user_info.name), str(info.user_info.role),
-                      str(search_quota), str(info.user_info.expired_at))
+        table.add_row(
+            str(info.user_info.name), str(info.user_info.role),
+            str(search_quota), str(info.user_info.expired_at)
+        )
         console.print(table)
         logger.info("User information retrieval is completed\n")
 
@@ -442,11 +414,9 @@ def command_searchcert(cls, hostname):
             Associate assets by calculating the SSL serial number of the domain name
             :param hostname: Enter the domain name using the HTTPS protocol
         """
-        try:
-            if encode.cert_encode(hostname) is not None:
-                return cls.__command_search(cls, "ssl:" + str(encode.cert_encode(hostname)))
-        except KeyboardInterrupt:
-            return
+        cert_hex_encode = encode.cert_encode(hostname)
+        if cert_hex_encode is not None:
+            return cls.__command_search(cls, "ssl:" + str(cert_hex_encode))
 
     @classmethod
     # ZoomEye Icon Image Search
@@ -497,10 +467,9 @@ def command_seebug(cls, search):
         """
         # Get Number of result sets of vulnerabilities
         total = Seebug.search(search).get("total")
-        # Get vulnerabilities result
-        data = Seebug.search(search)
         logger.info("Number of relevant vulnerabilities: {}".format(total))
-        for vuln in data["results"]:
+        # Get vulnerabilities result
+        for vuln in Seebug.search(search)["results"]:
             vuln = cls.convert(vuln)
             # Print Result set of framework history vulnerabilities
             logger_console.info('[{}] - [{}]'.format(vuln.name, vuln.id))
@@ -523,7 +492,7 @@ def command_view(cls, serial):
         """
             View raw data information
             You can view any raw data by entering the serial number
-            :param serial): Please enter serial number ID
+            :param serial: Please enter serial number ID
         """
         try:
             # If the key parameter is not specified, the key parameter is automatically set to 1
@@ -541,7 +510,8 @@ def command_view(cls, serial):
 
         except ArithmeticError:
             return logger.warning(
-                "No retrieval operation is performed or the length of the dictionary key value is exceeded")
+                "No retrieval operation is performed or the length of the dictionary key value is exceeded"
+            )
 
         finally:
             print()
@@ -552,7 +522,7 @@ def command_views(cls, serial):
         """
             View ssl raw data information
             You can views any ssl raw data by entering the serial number
-            :param serial): Please enter serial number ID
+            :param serial: Please enter serial number ID
         """
         try:
             # If the key parameter is not specified, the key parameter is automatically set to 1
@@ -571,34 +541,35 @@ def command_views(cls, serial):
             print()
 
     @classmethod
-    def command_show(cls, line):
-        pass
-
-    @classmethod
-    def command_searchkeyword(cls, *args, **kwargs):
+    def command_pupilsearch(cls, url):
+        """
+            Sensitive Data Retrieval
+            You can retrieve sensitive information leaks by entering a URL or ID
+            :param url: Please enter URL or ID
+        """
+        import re
+        from kunyu.config.setting import HTTP_CHECK_REGEX, NUMBER_CHECK_REGEX
         try:
-            keyword_param = set()
-            num = 0
-            # sensitive_params information
-            for sensitive in cls.sensitive_params:
-                for item in sensitive:
-                    keyword_param.add(item)
-            # Set table console print
-            table = Table(show_header=True, style="bold")
-            for column in SEMSITIVE_INFO:
-                table.add_column(
-                    column, justify="center", overflow=overflow
-                )
-            # add table information
-            for keyword in keyword_param:
-                num += 1
-                table.add_row(
-                    str(num), str(keyword)
-                )
-            # print sensitive info
-            console.print(table)
-        except Exception:
-            return
+            ParaInit(url, int(cls.thread), int(cls.deep), cls.all, cls.fuzz).main()
+            # Check if parameter is URL
+            if re.search(HTTP_CHECK_REGEX, url):
+                Pupil().main(cls.proxy)
+            # Check if parameter is Number
+            elif re.search(NUMBER_CHECK_REGEX, url):
+                # Get the banner information of the surveying and mapping data by ID
+                raw_data = cls.raw_data_params.get(int(url))
+                if raw_data is None:
+                    raise ArithmeticError
+                Pupil().response_main(raw_data)
+            else:
+                raise Exception
+        except ArithmeticError:
+            return logger.warning(
+                "No retrieval operation is performed or the length of the dictionary key value is exceeded"
+            )
+        except Exception as err:
+            print(err)
+            return logger.warning("Please enter appropriate parameters!")
 
     @classmethod
     def command_createmap(cls, *args, **kwargs):
@@ -610,8 +581,8 @@ def command_createmap(cls, *args, **kwargs):
         if len(cls.scatter_params) == 0: return logger.warning("Asset List is Empty,Please search and try again")
         from kunyu.config import setting
         # Generating an export path
-        __filename = datetime.datetime.now().strftime("ScatterGram_%H%M%S.html")
-        path = os.path.join(setting.OUTPUT_PATH, __filename)
+        path = os.path.join(setting.OUTPUT_PATH,
+                            datetime.datetime.now().strftime("ScatterGram_%H%M%S.html"))
         create_data_map(cls.scatter_params, path)
         # Output Export path
         logger.info(path)
@@ -633,10 +604,7 @@ def command_hostcrash(cls, args):
             # Determines whether the result set is empty
             if not result_list:
                 return logger.warning("The query result is empty\n")
-            table = Table(show_header=True, style="bold")
-            # Read the list header
-            for column in HOST_SCAN_INFO:
-                table.add_column(column, justify="center", overflow=overflow)
+            table = DisposeTables().result_table(HOST_SCAN_INFO, overflow)
             # Set output list content
             for res in result_list:
                 table.add_row(
@@ -651,9 +619,6 @@ def command_hostcrash(cls, args):
         except ArithmeticError:
             return logger.warning("Please Host IP and Domain")
 
-        except KeyboardInterrupt:
-            return
-
     @classmethod
     def command_alivescan(cls, *args, **kwargs):
         """
@@ -661,9 +626,7 @@ def command_alivescan(cls, *args, **kwargs):
         """
         from kunyu.utils.convert import convert
         ip_port_params, num = cls.scan_alive_params, 0
-        table = Table()
-        for column in ALIVE_SCAN_INFO:
-            table.add_column(column, justify="center", overflow=overflow)
+        table = DisposeTables().result_table(ALIVE_SCAN_INFO ,overflow)
         logger.info("IP Service Viability Scan:")
         # Polling output table content
         with Live(table, refresh_per_second=4):
@@ -674,8 +637,6 @@ def command_alivescan(cls, *args, **kwargs):
                     table.add_row(
                         str(num), alive_status.ip, str(alive_status.port), str(alive_status.state)
                     )
-                except KeyboardInterrupt:
-                    return
                 except Exception:
                     continue
         logger.info("IP Service Viability Scan is completed\n")
diff --git a/kunyu/lib/ExportHandler.py b/kunyu/lib/ExportHandler.py
new file mode 100644
index 0000000..e92f3c5
--- /dev/null
+++ b/kunyu/lib/ExportHandler.py
@@ -0,0 +1,75 @@
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: export.py
+@Time: 2022/3/18 15:53
+"""
+
+import re
+
+from rich.console import Console
+from kunyu.utils.log import logger
+from kunyu.lib.GlobalVariable import globalVariables as gbv
+
+console = Console(color_system="auto", record=True)
+
+class ExportHandler:
+    def __int__(self) -> None:
+        pass
+
+    def handler_sensitiveinformation(self, data):
+        """
+            Clears empty key-value pairs in dictionary deduplication
+        """
+        for k in list(data.keys()):
+            if not data[k]:
+                del data[k]
+        for k in data.keys():
+            data[k] = list(set(data[k]))
+
+    # Remove dirty data from matched ip
+    # First match the internal network ip, and then filter the external network ip.
+    # As long as there are two segments with more than 10 digits, it is considered to be an ip.
+    def handler_ip(self):
+        a_pattern = "10\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])"
+        b_pattern = "172\.(1[6789]|2[0-9]|3[01])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])"
+        c_pattern = "192\.168\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[0-9])"
+        d_pattern = "127.0.0.1"
+        pattern = re.compile("{}|{}|{}|{}".format(a_pattern, b_pattern, c_pattern, d_pattern))
+        removeip = []
+        for ip in gbv.Sensitiveinformation["Ip"]:
+            # Non-intranet ip for processing
+            if not re.search(pattern, ip):
+                sign = 0
+                for number in re.split("\.", ip):
+                    # Remove ip1 like 008.054.012.095, 084.043.126.085
+                    if (len(number)) > 0 and int(number[0]) == 0:
+                        removeip.append(ip)
+                        break
+                    if int(number) > 10:
+                        sign = sign + 1
+                if sign < 2:
+                    removeip.append(ip)
+        removeip = list(set(removeip))
+        for ip in removeip:
+            gbv.Sensitiveinformation["Ip"].remove(ip)
+
+    def main(self):
+
+        self.handler_sensitiveinformation(gbv.Sensitiveinformation)
+        try:
+            self.handler_ip()
+        except Exception:
+            pass
+
+        if gbv.apiresult:
+            logger.warning("Retrieving results API:")
+            console.print(list(set(gbv.apiresult)))
+            print("")
+        if gbv.urlresult:
+            logger.warning("Retrieving results URL:")
+            console.print((list(set(gbv.urlresult))))
+            print("")
+        if gbv.Sensitiveinformation:
+            logger.warning("Retrieving results KeyWord:")
+            console.print(gbv.Sensitiveinformation)
\ No newline at end of file
diff --git a/kunyu/lib/GlobalVariable.py b/kunyu/lib/GlobalVariable.py
new file mode 100644
index 0000000..389d091
--- /dev/null
+++ b/kunyu/lib/GlobalVariable.py
@@ -0,0 +1,59 @@
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: export.py
+@Time: 2022/3/18 15:53
+"""
+
+from typing import Any, Iterable, TypeVar
+
+NameType = TypeVar('NameType', str, Iterable[str])
+global globalVariables
+
+class GlobalVariable:
+    def __init__(self) -> None:
+        pass
+
+    def all(self):
+        attrs = [i for i in dir(self)]
+        attr = []
+        for i in range(len(attrs)):
+            if len(attrs[i]) > 1:
+                if '__' == attrs[i][:2]:
+                    continue
+            if attrs[i] in ['all', 'add', 'rm', 'get']:
+                continue
+
+            attr.append(attrs[i])
+        return attr
+
+    def add(self, name: NameType, value: Any):
+        if isinstance(name, Iterable) \
+                and (not isinstance(value, Iterable)):
+            raise TypeError("value should be Iterable when name is Iterable")
+        if type(name) is str:
+            name = [name]
+            value = [value]
+
+        for n, v in zip(name, value):
+            exec('self.{}={}'.format(n, v))
+
+    def rm(self, name: NameType):
+        if type(name) is str:
+            name = [name]
+        for n in name:
+            self.__delattr__(n)
+
+    def get(self, name: NameType):
+        if type(name) is str:
+            return self.__getattribute__(name)
+        else:
+            attrs = []
+            for n in name:
+                attrs.append(self.__getattribute__(n))
+            return attrs
+
+try:
+    tmp = globalVariables.all()
+except NameError:
+    globalVariables = GlobalVariable()
\ No newline at end of file
diff --git a/kunyu/lib/SerachData.py b/kunyu/lib/SerachData.py
new file mode 100644
index 0000000..09700aa
--- /dev/null
+++ b/kunyu/lib/SerachData.py
@@ -0,0 +1,207 @@
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: export.py
+@Time: 2022/3/18 15:53
+"""
+
+import os
+import re
+import threading
+from urllib import parse
+
+from bs4 import BeautifulSoup
+
+from kunyu.lib.GlobalVariable import globalVariables as gbv
+
+class DataHandler:
+
+    def __init__(self, url, response):
+
+        # Determine if rendering is required
+        # response.html.render(5)
+        response_parameter = str(response) if url == "http://www.kunyu.com/" else response.html.html
+        self.soup = BeautifulSoup(response_parameter, "lxml")
+        # Get the url path,
+        # ① and the result of search_js are spliced into a complete url for backtracking
+        # ② Compare with the result of search_url, and keep the url of the current domain name for backtracking.
+        self.baseurl = url
+        self.url = re.split(re.compile('/'), url[::-1], 1)[1][::-1] + "/"
+        self.response = response_parameter
+
+    # find data function
+    def search_data(self, pattern,flag=0):
+        tmplist = []
+        # Iterate over the string of all tags, while removing blank lines.
+        result = re.finditer(pattern, self.response)
+        # Some modules require iterators, some don't, depending on this flag to determine the return data type
+        if flag:
+            return result
+        for match in result:
+            tmplist.append(match.group())
+        # go back
+        return set(tmplist)
+
+    # Check if the current url may be the url of webpack, try to get the map
+    def webpack_map(self, url):
+        # Suspected to be js packaged by webpack, try to get map
+        pattern = re.compile("sourceMappingURL=.+.map$")
+        map_param = self.search_data(pattern)
+        if map_param:
+            sourceMappingURL = (re.compile("=").split(list(map_param)[0])[1])
+            gbv.track[gbv.trackdeep].append(self.url + sourceMappingURL)
+        elif url not in gbv.trackhistory:
+            webpackjs = ["main", "vend", "app", "chunk"]
+            for i in webpackjs:
+                if i in url:
+                    # The address of the map may be src.35edfdbe.map or src.35edfdbe.js.map
+                    gbv.track[gbv.trackdeep].append(url + ".map")
+
+    # html naturally has script tags, but js files do not exist, so only js in html can be extracted
+    # js of other files will be detected by searchurl
+    def search_js(self):
+        scheme = parse.urlparse(self.url).scheme
+        host = parse.urlparse(self.url).netloc
+        if host== "":
+            host= parse.urlparse(self.baseurl).netloc
+
+        # Set the filter of find_all to filter js tags but no innerhtml script (no innerhtml means remote scritp)
+        def is_script_but_no_innerhtml(tag):
+            return tag.string is None and tag.name == "script" and tag.has_attr("src")
+
+        self.webpack_map(self.baseurl)
+        # Get the js that needs to be accessed again, in list form
+        # Among them, if it is in the form of http, the probability is an external link, and no traceback
+        """
+            js is divided into the following three types, which need to be filled in a targeted manner
+            ../../js/xxx.js fill protocol + domain name + path ^(\.\.|\.)
+            //aaaaa.com/js/xxx.js padding protocol ^(//)
+            /js/xxx.js Fill protocol + domain name ^(/)(?!/)
+            js/xxx.js fill in the protocol + domain name + path + / and put it in the last elif
+        """
+        pattern1 = re.compile('^(\.\.|\.)')
+        pattern2 = re.compile('^(//)')
+        pattern3 = re.compile('^(/)(?!/)')
+        for script_item in self.soup.find_all(is_script_but_no_innerhtml):
+            if re.search(pattern1, script_item.attrs["src"]):
+                url = self.url + script_item.attrs["src"]
+            elif re.search(pattern2, script_item.attrs["src"]):
+                url = scheme + ":" + script_item.attrs["src"]
+            elif re.search(pattern3, script_item.attrs["src"]):
+                url = scheme + "://" + host + script_item.attrs["src"]
+            elif "http" not in script_item.attrs["src"]:
+                url = self.url + script_item.attrs["src"]
+            # If it is not the above situation, then basically only the external link with http or subdomain name is left to store js.
+            # In this case, we extract the main domain name or deal with it according to the specific situation (user input)
+            # Or we don't care, check them all
+            else:
+                url = script_item.attrs["src"]
+            gbv.track[gbv.trackdeep].append(url)
+
+    # Looking for interfaces, mainly in js, not in html, and basically no interfaces
+    def search_api(self):
+        pattern = re.compile("[\'\"][/]+[-A-Za-z0-9+&@#/%?=~_|!:.;]+")
+        apilist = self.search_data(pattern)
+        # Save the result stripped quotes to the global api list
+        for i in apilist:
+            if i[1:]== "//" or i[1:]== "/#":
+                continue
+            gbv.apiresult.append(i[1:])
+            if gbv.fuzz:
+                url=parse.urlparse(self.url).scheme+"://"+parse.urlparse(self.url).netloc+i[1:]
+                gbv.track[gbv.trackdeep].append(url)
+
+    # Find url (domain name or ip can match)
+    # Use the url of the current domain name for backtracking, and output other urls
+    def search_url(self):
+        # Extract the domain name in the url, and then use it to determine whether the url result should be used for backtracking
+        host = parse.urlparse(self.url).netloc
+        blacklist = [".png", ".gif", ".css", ".jpg", ".video", ".mp4",".ico",".ttf",".svg",".woff2",".woff",".m4s"]
+        pattern = re.compile(r"(https?|ftp|file|ssh|smb|mysql)://[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]")
+        urllist = self.search_data(pattern)
+        # remove some references to external sites
+        pattern2 = re.compile(
+            "(lodash.com|feross.org|gov.cn|github.com|github.io|vuejs.org|w3.org|mozilla.org|nodejs.org|google.com|chromium.org|w3help.org|whatwg.org|stackoverflow.com|ecma-international.org|underscorejs.org|flow.org|wikipedia.org|baidu.com)"
+        )
+        for i in urllist:
+            # Do not in the domain name blacklist list
+            if re.search(pattern2, i):
+                continue
+            # Remove front-end resources such as images and css
+            _, file_suffix = os.path.splitext(parse.urlparse(i).path)
+            if file_suffix in blacklist:
+                continue
+            # Save the url of the current domain name to the track list for backtracking
+            # If global search is enabled, all of them will be added to the backtracking queue, otherwise only the current domain name will be added.
+            gbv.urlresult.append(i)
+            if gbv.searchany:
+                gbv.track[gbv.trackdeep].append(i)
+            elif host in i:
+                gbv.track[gbv.trackdeep].append(i)
+
+
+    # https://bacde.me/post/Extract-API-Keys-From-Regex/
+    # https://www.cnblogs.com/timelesszhuang/p/5014595.html
+    # accesskey、appid、password、proxy token、
+    def search_other(self):
+        # 使用正则捕获组来获取数据归属
+        Jwt = "(?P<Jwt>(ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}|ey[A-Za-z0-9_\/+-]{10,}\.[A-Za-z0-9._\/+-]{10,}\.[A-Za-z0-9._-]{10,}))"
+        Ip = "(?P<Ip>((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})(\.((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})){3})"
+        Email = "(?P<Email>([a-zA-Z0-9][_|\.])*[a-zA-Z0-9]+@([a-zA-Z0-9][-|_|\.])*[a-zA-Z0-9]+\.((?!js|css|jpg|jpeg|png|ico|webp)[a-zA-Z]{2,}))"
+        ChinaIdCard = "(?P<ChinaIdCard>[1-8][1-7]\d{4}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dX])"
+        ChinaMobile = "(?P<ChinaMobile>[^\w]((?:(?:\+|00)86)?1(?:(?:3[\d])|(?:4[5-79])|(?:5[0-35-9])|(?:6[5-7])|(?:7[0-8])|(?:8[\d])|(?:9[189]))\d{8})[^\w])"
+        AccessKey = "(?P<AccessKey>([Aa](ccess|CCESS)_?[Kk](ey|EY)|[Aa](ccess|CCESS)_?[sS](ecret|ECRET)|[Aa](ccess|CCESS)_?(id|ID|Id)|[Aa](ccess|CCESS)[A-Za-z0-9_-]{5,10})[A-Za-z0-9\"'\s]{0,10}[=:][\s\"\']{1,5}[A-Za-z0-9]{2,30}[\"'])"
+        SecretKey = "(?P<SecretKey>([Ss](ecret|ECRET)_?[Kk](ey|EY)|[Ss](ecret|ECRET)_?(id|ID|Id)|[Ss](ecret|ECRET))[^)(|]{0,10}[=:][A-Za-z0-9\"'\s]{2,30}[\"'])"
+        AppId = "(?P<AppId>([Aa](pp|PP)_?[Ii][dD]|[Aa](pp|PP)_?[Kk](ey|EY)|[Aa](pp|PP)_?[Ss](ecret|ECRET))[^)(|]{0,10}[=:][\s\"\']{1,5}[^):'\"+(|]{5,30}[\"'])"
+        UserName = "(?P<UserName>([Uu](ser|SER)_?[Nn](ame|AME))[^)(|,\"'\+]{0,10}[=:][\s\"\']{1,5}[^)(|\s=,]{2,30}[\"'])"
+        PassWord = "(?P<PassWord>([Pp](ass|ASS)_?[Ww](ord|ORD|D|d))[^)(|,\"'\+]{0,10l}[=:][\s\"\']{1,5}[^)(|\s=]{2,30}[\"'])"
+
+        # Not tested.
+        SSHKey = "(?P<SSHKey>-----BEGIN PRIVATE KEY-----[a-zA-Z0-9\\S]{100,}-----END PRIVATE KEY——)"
+        RSAKey = "(?P<RSAKey>-----BEGIN RSA PRIVATE KEY-----[a-zA-Z0-9\\S]{100,}-----END RSA PRIVATE KEY-----)"
+        GithubAccessKey = "(?P<GithubAccessKey>[a-zA-Z0-9_-]*:[a-zA-Z0-9_\\-]+@github\\.com*)"
+
+        pattern = re.compile("{Jwt}|{Ip}|{Email}|{ChinaIdCard}|{ChinaMobile}|{AccessKey}|{SecretKey}|{AppId}|{UserName}|{PassWord}|{SSHKey}|{RSAKey}|{GithubAccessKey}".format(Jwt=Jwt, Ip=Ip,Email = Email,ChinaIdCard=ChinaIdCard,ChinaMobile=ChinaMobile  , AccessKey=AccessKey, SecretKey=SecretKey, AppId=AppId, UserName=UserName,PassWord=PassWord ,SSHKey=SSHKey ,RSAKey=RSAKey , GithubAccessKey=GithubAccessKey))
+        result = self.search_data(pattern,1)
+        for i in result:
+            if i.group("Jwt"):
+                gbv.Sensitiveinformation["Jwt"].append(i.group("Jwt"))
+            elif i.group("Ip"):
+                gbv.Sensitiveinformation["Ip"].append(i.group("Ip"))
+            elif i.group("Email"):
+                gbv.Sensitiveinformation["Email"].append(i.group("Email"))
+            elif i.group("ChinaIdCard"):
+                gbv.Sensitiveinformation["ChinaIdCard"].append(i.group("ChinaIdCard"))
+            elif i.group("AccessKey"):
+                gbv.Sensitiveinformation["AccessKey"].append(i.group("AccessKey"))
+            elif i.group("SecretKey"):
+                gbv.Sensitiveinformation["SecretKey"].append(i.group("SecretKey"))
+            elif i.group("AppId"):
+                gbv.Sensitiveinformation["AppId"].append(i.group("AppId"))
+            elif i.group("UserName"):
+                gbv.Sensitiveinformation["UserName"].append(i.group("UserName"))
+            elif i.group("PassWord"):
+                gbv.Sensitiveinformation["PassWord"].append(i.group("PassWord"))
+            elif i.group("SSHKey"):
+                gbv.Sensitiveinformation["SSHKey"].append(i.group("SSHKey"))
+            elif i.group("RSAKey"):
+                gbv.Sensitiveinformation["RSAKey"].append(i.group("RSAKey"))
+            elif i.group("GithubAccessKey"):
+                gbv.Sensitiveinformation["GithubAccessKey"].append(i.group("GithubAccessKey"))
+            else:
+                pass
+
+    def main(self):
+        t = threading.Thread(target=self.search_url)
+        t.start()
+        t1 = threading.Thread(target=self.search_js)
+        t1.start()
+        t2 = threading.Thread(target=self.search_api)
+        t2.start()
+        t.join()
+        t1.join()
+        t2.join()
+        t3 = threading.Thread(target=self.search_other)
+        t3.start()
+        t3.join()
+        return len(self.response)
diff --git a/kunyu/lib/TrackUrl.py b/kunyu/lib/TrackUrl.py
new file mode 100644
index 0000000..2fc86fe
--- /dev/null
+++ b/kunyu/lib/TrackUrl.py
@@ -0,0 +1,106 @@
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: export.py
+@Time: 2022/3/18 15:53
+"""
+
+import random
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+import requests
+from urllib import parse
+from rich.console import Console
+from requests_html import HTMLSession
+from requests.packages.urllib3.exceptions import InsecureRequestWarning
+
+from kunyu.utils.log import logger
+from kunyu.config.setting import UA
+import kunyu.lib.SerachData as SerachData
+import kunyu.lib.ExportHandler as ExportHandler
+from kunyu.lib.GlobalVariable import globalVariables as gbv
+
+requests.packages.urllib3.disable_warnings()
+console = Console(color_system="auto", record=True)
+
+class Track:
+    def __init__(self):
+
+        self.headers = {
+            'User-Agent': random.choice(UA),
+            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
+            'Accept-Encoding': 'gzip, deflate',
+            'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
+            'Upgrade-Insecure-Requests': '1'
+        }
+        self.proxy = gbv.proxy
+
+        if self.proxy:
+            console.print(self.proxy)
+            scheme = parse.urlparse(gbv.proxy).scheme
+            self.proxy={
+                scheme:self.proxy
+            }
+        self.requests = HTMLSession(verify=False)
+
+    # requestsRequest method
+    def req(self, url):
+        try:
+            response = self.requests.get(
+                url, headers=self.headers, proxies=self.proxy,timeout=5
+            )
+            # Record the successfully queried url into the history table,
+            # output the results on the one hand, and prevent repeated queries on the other hand
+            gbv.trackhistory.append(url)
+            content=SerachData.DataHandler(url, response).main()
+            console.print('URL:{}   STATUS:{}'.format(url, response.status_code))
+            return response
+        except Exception as e:
+            gbv.trackhistory.append(url)
+            return False
+
+    # Backtrack according to backtracking rules
+    def track_search(self):
+        # Traverse the tarck list for backtracking, dynamically add urls in the middle,
+        # gbv.track list is of the form [[layer 0],[layer 1 traceback],[layer 2]]
+
+        for deepurl in gbv.track:
+            # Although the maximum traceability depth has not been reached, new data cannot be traced
+            if not deepurl:
+                logger.warning("Fixed at depth {} and no new data can be found".format(gbv.trackdeep - 1))
+                return False
+            # Determine whether the backtracking depth reaches the maximum backtracking depth
+            if gbv.trackdeep > gbv.deep:
+                return False
+            # You can continue to trace if it is not there.
+            gbv.trackdeep = gbv.trackdeep + 1
+            gbv.track.append([])
+            # It needs to be rendered for the first time to prevent some pages from being formed by js and not loaded.
+            # This is especially common in webpack
+            # Because this rendering is an asynchronous operation, it is not easy to use threads, so it is a bit redundant to extract it separately.
+            if gbv.trackdeep == 1:
+                url = deepurl[0]
+                response = self.requests.get(
+                    url=url, headers=self.headers, proxies=self.proxy, verify=False, timeout=5
+                )
+                #response = self.requests.get(url=url, headers=self.headers, verify=False,timeout=5)
+                # Rendering incurable diseases, if it doesn't work, it will not be rendered.
+                try:
+                    response.html.render(timeout=5)
+                except Exception:
+                    pass
+                gbv.trackhistory.append(url)
+                SerachData.DataHandler(url, response).main()
+
+            # Multithreading
+            else:
+                with ThreadPoolExecutor(max_workers=gbv.thread) as thread:
+                    for url in deepurl:
+                        # Avoid duplicate queries
+                        if url in gbv.trackhistory:
+                            continue
+                        thread.submit(self.req, url)
+
+    def main(self):
+        self.track_search()
+        ExportHandler.ExportHandler().main()
diff --git a/kunyu/lib/batchfile.py b/kunyu/lib/batchfile.py
index 8b286f1..a3f622b 100644
--- a/kunyu/lib/batchfile.py
+++ b/kunyu/lib/batchfile.py
@@ -51,13 +51,15 @@ def getfile(file):
 @getresult
 def __check_file_ip(ip):
     # Check IP legitimacy
-    return True if re.search(IP_ADDRESS_REGEX, ip) else logger.warning(ip + ":It's an illegal IP address")
+    return True if re.search(IP_ADDRESS_REGEX, ip) \
+        else logger.warning(ip + ":It's an illegal IP address")
 
 
 @getresult
 def __check_file_domain(domain):
     # Check DOMAIN legitimacy
-    return True if re.search(DOMAIN_CHECK_REGEX, domain) else logger.warning(domain + ":It's an illegal Domain")
+    return True if re.search(DOMAIN_CHECK_REGEX, domain) \
+        else logger.warning(domain + ":It's an illegal Domain")
 
 
 # Get the contents of the Domain list.
diff --git a/kunyu/lib/encode.py b/kunyu/lib/encode.py
index 36c3e08..7af2dfe 100644
--- a/kunyu/lib/encode.py
+++ b/kunyu/lib/encode.py
@@ -83,30 +83,25 @@ def http_encode(self):
 def encode_md5(filename):
     return filename, True
 
-
 # Calculate mmh3 Hash
 @EncodeHash
 def encode_mmh3(filename):
     return filename, False
 
-
 # encode hex
 def encode_hex(string):
     return int(string, 16)
 
-
 # encode base64
 def encode_base64(string):
     bytes_str = string.encode("utf-8")
     return str(base64.b64encode(bytes_str).decode("utf-8"))
 
-
 # Cert series number calculate Hash
 def cert_encode(hostname):
     try:
-        c = ssl.create_default_context()
         host = re.sub(HTTP_CHECK_REGEX, '', hostname)
-        s = c.wrap_socket(socket.socket(), server_hostname=host)
+        s = ssl.create_default_context().wrap_socket(socket.socket(), server_hostname=host)
         s.settimeout(5)
         s.connect((host, 443))
         # Return Hexadecimal code
diff --git a/kunyu/lib/export.py b/kunyu/lib/export.py
index cd6d70b..f4086dc 100644
--- a/kunyu/lib/export.py
+++ b/kunyu/lib/export.py
@@ -1,20 +1,18 @@
 #!/usr/bin/env python
 # encoding: utf-8
-'''
+"""
 @author: 风起
 @contact: onlyzaliks@gmail.com
 @File: export.py
 @Time: 2021/6/22 15:53
-'''
+"""
 
 import os
 import datetime
 
-import csv
 import xlwt
 
 from kunyu.core import conf
-from kunyu.utils.log import logger
 from kunyu.config import setting
 
 """"
@@ -30,32 +28,14 @@
 
 def createdir():
     # Create the results output directory.
-    __dirnamae = datetime.datetime.now().strftime("%Y%m%d%H%M")
-    path = os.path.expanduser(OUTPUT_PATH)
-    __path = os.path.join(path, __dirnamae)
+    __path = os.path.join(os.path.expanduser(OUTPUT_PATH),
+                          datetime.datetime.now().strftime("%Y%m%d%H%M"))
     setting.OUTPUT_PATH = __path
     if os.path.exists(__path):
         return 0
     # Create Directory
     os.makedirs(__path)
 
-
-def export_csv(columns, data):
-    # The export file format is CSV
-    __filename = datetime.datetime.now().strftime("%H%M%S.csv")
-    path = os.path.join(setting.OUTPUT_PATH, __filename)
-    try:
-        with open(path, "a", newline='', encoding="utf-8-sig") as f:
-            writer = csv.writer(f)
-            writer.writerow(columns)
-            for num, key in enumerate(data["results"]):
-                writer.writerow([str(num + 1), key[0], key[1], key[2], key[3], key[4], key[5], key[6]])
-
-    except Exception:
-        logger.error("hope you don't Batch scanning")
-    logger.info("File export Path:" + path)
-
-
 def export_xls(content, head):
     style_head = xlwt.XFStyle()
     font = xlwt.Font()
@@ -74,8 +54,7 @@ def export_xls(content, head):
     excel = xlwt.Workbook(encoding='utf-8')
     sheet = excel.add_sheet("坤舆")
     for i in range(10):
-        first_col_1 = sheet.col(i)
-        first_col_1.width = 256 * 20
+        sheet.col(i).width = 256 * 20
     for index, value in enumerate(head):
         sheet.write(0, index, value, style_head)
 
@@ -99,17 +78,9 @@ def export_xls(content, head):
             sheet.write(index, i, value, style)
 
     # Save excel file
-    __time = datetime.datetime.now().strftime("%H%M%S.xls")
-    file_name = excel.save(os.path.join(setting.OUTPUT_PATH, __time))
+    file_name = excel.save(os.path.join(setting.OUTPUT_PATH,
+                                        datetime.datetime.now().strftime("%H%M%S.xls")))
     return file_name
 
-
-def export_txt(console):
-    # The export file format is TXT
-    __time = datetime.datetime.now().strftime("%H%M%S.txt")
-    path = os.path.join(setting.OUTPUT_PATH, __time)
-    console.save_text(path)
-
-
 if __name__ == "__main__":
     createdir()
diff --git a/kunyu/utils/tables.py b/kunyu/utils/tables.py
new file mode 100644
index 0000000..a3e1865
--- /dev/null
+++ b/kunyu/utils/tables.py
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+# encoding: utf-8
+"""
+@author: 风起
+@contact: onlyzaliks@gmail.com
+@File: tables.py
+@Time: 2022/3/17 11:05
+"""
+
+from rich.table import Table
+
+class DisposeTables:
+    def __init__(self) -> None:
+        self.tables = Table(show_header=True, style="bold")
+
+    def result_table(self, title, overflow="ignore"):
+        for cloumn in title:
+            self.tables.add_column(
+                cloumn, justify="center", overflow=overflow
+            )
+        return self.tables
diff --git a/requirements.txt b/requirements.txt
index 276acf4..e4ddd7c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,3 +10,7 @@ colorama
 pocsuite3
 colorlog
 setuptools
+pyee==7.0.3
+urllib3
+beautifulsoup4
+requests-html