Translated ['src/pentesting-web/hacking-with-cookies/README.md'] to sw

src/pentesting-web/hacking-with-cookies/README.md

@@ -12,7 +12,7 @@ Tarehe ya kumalizika kwa cookie inamuliwa na sifa ya `Expires`. Kinyume chake, s
 
 ### Domain
 
-Wenyeji wa kupokea cookie wanaelezwa na sifa ya `Domain`. Kwa kawaida, hii imewekwa kwa mwenyeji aliyeitoa cookie, bila kujumuisha subdomains zake. Hata hivyo, wakati sifa ya `Domain` imewekwa wazi, inajumuisha subdomains pia. Hii inafanya ufafanuzi wa sifa ya `Domain` kuwa chaguo lenye ukomo mdogo, muhimu kwa hali ambapo kushiriki cookie kati ya subdomains kunahitajika. Kwa mfano, kuweka `Domain=mozilla.org` kunafanya cookies zipatikane kwenye subdomains zake kama `developer.mozilla.org`.
+Wenyeji wa kupokea cookie wanaelezwa na sifa ya `Domain`. Kwa kawaida, hii imewekwa kwa mwenyeji aliyeanzisha cookie, bila kujumuisha subdomains zake. Hata hivyo, wakati sifa ya `Domain` imewekwa wazi, inajumuisha subdomains pia. Hii inafanya uwekaji wa sifa ya `Domain` kuwa chaguo lenye ukomo mdogo, muhimu kwa hali ambapo kushiriki cookie kati ya subdomains kunahitajika. Kwa mfano, kuweka `Domain=mozilla.org` kunafanya cookies zipatikane kwenye subdomains zake kama `developer.mozilla.org`.
 
 ### Path
 
@@ -27,7 +27,7 @@ Wakati cookies mbili zina jina sawa, ile iliyochaguliwa kutumwa inategemea:
 
 ### SameSite
 
-- Sifa ya `SameSite` inaamuru ikiwa cookies zitatumwa kwenye maombi yanayotokana na maeneo ya upande wa tatu. Inatoa mipangilio mitatu:
+- Sifa ya `SameSite` inaelekeza ikiwa cookies zitatumwa kwenye maombi yanayotokana na maeneo ya upande wa tatu. Inatoa mipangilio mitatu:
 - **Strict**: Inazuia cookie kutumwa kwenye maombi ya upande wa tatu.
 - **Lax**: Inaruhusu cookie kutumwa na maombi ya GET yanayoanzishwa na tovuti za upande wa tatu.
 - **None**: Inaruhusu cookie kutumwa kutoka kwa eneo lolote la upande wa tatu.
@@ -44,11 +44,11 @@ Kumbuka, wakati wa kuunda cookies, kuelewa sifa hizi kunaweza kusaidia kuhakikis
 | AJAX             | $.get("...")                       | NotSet\*, None        |
 | Image            | \<img src="...">                   | NetSet\*, None        |
 
-Jedwali kutoka [Invicti](https://www.netsparker.com/blog/web-security/same-site-cookie-attribute-prevent-cross-site-request-forgery/) na kidogo kubadilishwa.\
-Cookie yenye sifa ya _**SameSite**_ itapunguza **shambulio la CSRF** ambapo kikao kilichoingia kinahitajika.
+Table from [Invicti](https://www.netsparker.com/blog/web-security/same-site-cookie-attribute-prevent-cross-site-request-forgery/) and slightly modified.\
+A cookie with _**SameSite**_ attribute will **mitigate CSRF attacks** where a logged session is needed.
 
-**\*Kumbuka kwamba kuanzia Chrome80 (feb/2019) tabia ya kawaida ya cookie bila sifa ya cookie samesite** **itakuwa lax** ([https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/](https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/)).\
-Kumbuka kwamba kwa muda, baada ya kutumia mabadiliko haya, **cookies bila sera ya SameSite** **katika Chrome zitachukuliwa kama None** wakati wa **dakika 2 za kwanza na kisha kama Lax kwa ombi la POST la juu la msalaba.**
+**\*Notice that from Chrome80 (feb/2019) the default behaviour of a cookie without a cookie samesite** **attribute will be lax** ([https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/](https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/)).\
+Notice that temporary, after applying this change, the **cookies without a SameSite** **policy** in Chrome will be **treated as None** during the **first 2 minutes and then as Lax for top-level cross-site POST request.**
 
 ## Cookies Flags
 
@@ -58,7 +58,7 @@ Hii inazuia **mteja** kufikia cookie (Kupitia **Javascript** kwa mfano: `documen
 
 #### **Bypasses**
 
-- Ikiwa ukurasa unatumia **cookies kama jibu** la maombi (kwa mfano katika ukurasa wa **PHPinfo**), inawezekana kutumia XSS kutuma ombi kwa ukurasa huu na **kuiba cookies** kutoka kwa jibu (angalia mfano katika [https://hackcommander.github.io/posts/2022/11/12/bypass-httponly-via-php-info-page/](https://hackcommander.github.io/posts/2022/11/12/bypass-httponly-via-php-info-page/)).
+- Ikiwa ukurasa unatumia **cookies kama jibu** la maombi (kwa mfano katika ukurasa wa **PHPinfo**), inawezekana kutumia XSS kutuma ombi kwa ukurasa huu na **kuiba cookies** kutoka kwa jibu (angalia mfano katika [https://blog.hackcommander.com/posts/2022/11/12/bypass-httponly-via-php-info-page/](https://blog.hackcommander.com/posts/2022/11/12/bypass-httponly-via-php-info-page/)).
 - Hii inaweza kupitishwa kwa maombi ya **TRACE** **HTTP** kwani jibu kutoka kwa seva (ikiwa njia hii ya HTTP inapatikana) itarudisha cookies zilizotumwa. Mbinu hii inaitwa **Cross-Site Tracking**.
 - Mbinu hii inakwepa na **vivinjari vya kisasa kwa kutoruhusu kutuma ombi la TRACE** kutoka JS. Hata hivyo, baadhi ya njia za kupita hii zimepatikana katika programu maalum kama kutuma `\r\nTRACE` badala ya `TRACE` kwa IE6.0 SP2.
 - Njia nyingine ni kutumia udhaifu wa zero/day wa vivinjari.
@@ -72,24 +72,24 @@ cookie-jar-overflow.md
 
 ### Secure
 
-Ombi litatumwa **tu** kutuma cookie katika ombi la HTTP tu ikiwa ombi linatumwa kupitia njia salama (kawaida **HTTPS**).
+Ombi litatumia **tu** cookie katika ombi la HTTP ikiwa ombi linatumwa kupitia njia salama (kawaida **HTTPS**).
 
 ## Cookies Prefixes
 
-Cookies zilizo na kiambishi `__Secure-` zinahitajika kuwekwa pamoja na bendera ya `secure` kutoka kurasa ambazo zimehakikishwa na HTTPS.
+Cookies zilizo na awali `__Secure-` zinahitajika kuwekwa pamoja na bendera ya `secure` kutoka kurasa ambazo zimehakikishwa na HTTPS.
 
-Kwa cookies zilizo na kiambishi `__Host-`, masharti kadhaa yanapaswa kutimizwa:
+Kwa cookies zilizo na awali `__Host-`, masharti kadhaa yanapaswa kutimizwa:
 
 - Lazima ziwe zimewekwa na bendera ya `secure`.
-- Lazima zitoke kwenye ukurasa uliohakikishwa na HTTPS.
+- Lazima zianze kutoka ukurasa uliohakikishwa na HTTPS.
 - Zinakatazwa kuainisha domain, kuzuia usafirishaji wao kwa subdomains.
 - Njia ya cookies hizi lazima iwekwe kwa `/`.
 
-Ni muhimu kutambua kwamba cookies zilizo na kiambishi `__Host-` haziruhusiwi kutumwa kwa superdomains au subdomains. Kizuizi hiki kinasaidia katika kutenga cookies za programu. Hivyo, kutumia kiambishi `__Host-` kwa cookies zote za programu inaweza kuzingatiwa kama mazoea mazuri ya kuboresha usalama na kutengwa.
+Ni muhimu kutambua kwamba cookies zilizo na awali `__Host-` haziruhusiwi kutumwa kwa superdomains au subdomains. Kizuizi hiki kinasaidia katika kutenga cookies za programu. Hivyo, kutumia awali ya `__Host-` kwa cookies zote za programu inaweza kuzingatiwa kama mazoea mazuri ya kuboresha usalama na kutengwa.
 
 ### Overwriting cookies
 
-Hivyo, moja ya ulinzi wa cookies zilizo na kiambishi `__Host-` ni kuzuia ziweze kufutwa kutoka subdomains. Kuzuia kwa mfano [**Cookie Tossing attacks**](cookie-tossing.md). Katika mazungumzo [**Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities**](https://www.youtube.com/watch?v=F_wAzF4a7Xg) ([**paper**](https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf)) inawasilishwa kwamba ilikuwa inawezekana kuweka cookies zilizo na kiambishi \_\_HOST- kutoka subdomain, kwa kudanganya parser, kwa mfano, kuongeza "=" mwanzoni au mwishoni...:
+Hivyo, moja ya ulinzi wa cookies zilizo na awali `__Host-` ni kuzuia ziweze kufutwa kutoka subdomains. Kuzuia kwa mfano [**Cookie Tossing attacks**](cookie-tossing.md). Katika mazungumzo [**Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities**](https://www.youtube.com/watch?v=F_wAzF4a7Xg) ([**paper**](https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf)) inawasilishwa kwamba ilikuwa inawezekana kuweka cookies zilizo na awali \_\_HOST- kutoka subdomain, kwa kudanganya parser, kwa mfano, kuongeza "=" mwanzoni au mwishoni...:
 
 <figure><img src="../../images/image (6) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
 
@@ -103,15 +103,15 @@ Ikiwa cookie maalum ina data nyeti angalia hiyo (hasa ikiwa unacheza CTF), kwani
 
 ### Decoding and Manipulating Cookies
 
-Data nyeti iliyowekwa ndani ya cookies inapaswa daima kuchunguzwa. Cookies zilizowekwa katika Base64 au mifumo inayofanana mara nyingi zinaweza kufichuliwa. Udhaifu huu unaruhusu washambuliaji kubadilisha maudhui ya cookie na kujifanya watumiaji wengine kwa kuandika data zao zilizobadilishwa tena ndani ya cookie.
+Data nyeti iliyojumuishwa katika cookies inapaswa daima kuchunguzwa. Cookies zilizowekwa katika Base64 au mifumo inayofanana mara nyingi zinaweza kufichuliwa. Udhaifu huu unaruhusu washambuliaji kubadilisha maudhui ya cookie na kujifanya watumiaji wengine kwa kuandika data zao zilizobadilishwa tena ndani ya cookie.
 
 ### Session Hijacking
 
-Shambulio hili linahusisha kuiba cookie ya mtumiaji ili kupata ufikiaji usioidhinishwa kwa akaunti yao ndani ya programu. Kwa kutumia cookie iliyibwa, mshambuliaji anaweza kujifanya mtumiaji halali.
+Shambulio hili linahusisha kuiba cookie ya mtumiaji ili kupata ufikiaji usioidhinishwa kwa akaunti yao ndani ya programu. Kwa kutumia cookie iliyop stolen, mshambuliaji anaweza kujifanya mtumiaji halali.
 
 ### Session Fixation
 
-Katika hali hii, mshambuliaji anamdanganya mwathirika kutumia cookie maalum kuingia. Ikiwa programu haitoi cookie mpya wakati wa kuingia, mshambuliaji, akiwa na cookie ya awali, anaweza kujifanya mwathirika. Mbinu hii inategemea mwathirika kuingia na cookie iliyotolewa na mshambuliaji.
+Katika hali hii, mshambuliaji anamdanganya mwathirika kutumia cookie maalum kuingia. Ikiwa programu haitoi cookie mpya wakati wa kuingia, mshambuliaji, mwenye cookie ya awali, anaweza kujifanya mwathirika. Mbinu hii inategemea mwathirika kuingia na cookie iliyotolewa na mshambuliaji.
 
 Ikiwa umepata **XSS katika subdomain** au unadhibiti **subdomain**, soma:
 
@@ -131,7 +131,7 @@ cookie-tossing.md
 
 ### [JWT Cookies](../hacking-jwt-json-web-tokens.md)
 
-Bonyeza kwenye kiungo kilichopita kupata ukurasa unaofafanua udhaifu unaowezekana katika JWT.
+Bonyeza kwenye kiungo kilichotangulia ili kufikia ukurasa unaoelezea udhaifu unaowezekana katika JWT.
 
 JSON Web Tokens (JWT) zinazotumiwa katika cookies pia zinaweza kuonyesha udhaifu. Kwa maelezo ya kina kuhusu udhaifu unaowezekana na jinsi ya kuyatumia, inashauriwa kufikia hati iliyo kwenye kuhamasisha JWT.
 
@@ -141,7 +141,7 @@ Shambulio hili linamfanya mtumiaji aliyeingia kutekeleza vitendo visivyotakikana
 
 ### Empty Cookies
 
-(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Vivinjari vinaruhusu kuundwa kwa cookies bila jina, ambayo inaweza kuonyeshwa kupitia JavaScript kama ifuatavyo:
+(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Vivinjari vinaruhusu kuunda cookies bila jina, ambayo inaweza kuonyeshwa kupitia JavaScript kama ifuatavyo:
 ```js
 document.cookie = "a=v1"
 document.cookie = "=test value;" // Setting an empty named cookie
@@ -157,48 +157,47 @@ setCookie("", "a=b") // Setting the empty cookie modifies another cookie's value
 ```
 Hii inasababisha kivinjari kutuma kichwa cha cookie kinachotafsiriwa na kila seva ya wavuti kama cookie iliyo na jina `a` na thamani `b`.
 
-#### Chrome Bug: Tatizo la Unicode Surrogate Codepoint
+#### Chrome Bug: Tatizo la Kiwango cha Unicode Surrogate
 
-Katika Chrome, ikiwa codepoint ya Unicode surrogate ni sehemu ya cookie iliyowekwa, `document.cookie` inaharibika, ikirudisha string tupu baadaye:
+Katika Chrome, ikiwa kiwango cha Unicode surrogate ni sehemu ya cookie iliyowekwa, `document.cookie` inaharibika, ikirudisha string tupu baadaye:
 ```js
 document.cookie = "\ud800=meep"
 ```
 Hii inasababisha `document.cookie` kutoa string tupu, ikionyesha uharibifu wa kudumu.
 
-#### Cookie Smuggling Kutokana na Masuala ya Parsing
+#### Uhamasishaji wa Keki kutokana na Masuala ya Uchambuzi
 
-(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Seva kadhaa za wavuti, ikiwa ni pamoja na zile za Java (Jetty, TomCat, Undertow) na Python (Zope, cherrypy, web.py, aiohttp, bottle, webob), zinashughulikia nyuzi za cookie vibaya kutokana na msaada wa zamani wa RFC2965. Wanasoma thamani ya cookie iliyo na nukuu mbili kama thamani moja hata kama inajumuisha alama za semikolon, ambazo kawaida zinapaswa kutenganisha jozi za funguo-thamani:
+(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Seva kadhaa za wavuti, ikiwa ni pamoja na zile za Java (Jetty, TomCat, Undertow) na Python (Zope, cherrypy, web.py, aiohttp, bottle, webob), zinashughulikia nyuzi za keki vibaya kutokana na msaada wa zamani wa RFC2965. Wanasoma thamani ya keki iliyo na nukuu mbili kama thamani moja hata kama inajumuisha alama za semikolon, ambazo kawaida zinapaswa kutenganisha jozi za funguo-thamani:
 ```
 RENDER_TEXT="hello world; JSESSIONID=13371337; ASDF=end";
 ```
-#### Ukatili wa Kuingiza Cookies
+#### Uthibitisho wa Uvunjaji wa Keki
 
-(Tafadhali angalia maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Ufafanuzi usio sahihi wa cookies na seva, hasa Undertow, Zope, na zile zinazotumia `http.cookie.SimpleCookie` na `http.cookie.BaseCookie` za Python, unatoa fursa za mashambulizi ya kuingiza cookies. Seva hizi zinashindwa kuweka mipaka sahihi ya kuanza kwa cookies mpya, ikiruhusu washambuliaji kuiga cookies:
+(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Ufafanuzi usio sahihi wa keki na seva, hasa Undertow, Zope, na zile zinazotumia `http.cookie.SimpleCookie` na `http.cookie.BaseCookie` za Python, unatoa fursa za mashambulizi ya kuingiza keki. Seva hizi zinashindwa kuweka mipaka sahihi ya kuanza kwa keki mpya, ikiruhusu washambuliaji kuiga keki:
 
-- Undertow inatarajia cookie mpya mara moja baada ya thamani iliyonukuliwa bila alama ya semikolon.
-- Zope inatafuta koma ili kuanza kufafanua cookie inayofuata.
-- Madarasa ya cookie ya Python yanaanza kufafanua kwenye herufi ya nafasi.
+- Undertow inatarajia keki mpya mara moja baada ya thamani iliyonukuliwa bila alama ya semikolon.
+- Zope inatafuta koma ili kuanza kufafanua keki inayofuata.
+- Madarasa ya keki ya Python yanaanza kufafanua kwenye herufi ya nafasi.
 
-Ukatili huu ni hatari hasa katika programu za wavuti zinazotegemea ulinzi wa CSRF wa msingi wa cookies, kwani unaruhusu washambuliaji kuingiza cookies za CSRF-token zilizoghushi, na hivyo kuweza kupita hatua za usalama. Tatizo hili linazidishwa na jinsi Python inavyoshughulikia majina ya cookie yanayojirudia, ambapo tukio la mwisho linazidi yale ya awali. Pia linaibua wasiwasi kwa `__Secure-` na `__Host-` cookies katika muktadha usio salama na linaweza kusababisha kupita kwa mamlaka wakati cookies zinapopita kwa seva za nyuma zinazoweza kudanganywa.
+Uthibitisho huu ni hatari sana katika programu za wavuti zinazotegemea ulinzi wa CSRF wa keki, kwani unaruhusu washambuliaji kuingiza keki za CSRF-token zilizoghushi, na hivyo kuweza kupita hatua za usalama. Tatizo hili linazidishwa na jinsi Python inavyoshughulikia majina ya keki yanayojirudia, ambapo tukio la mwisho linazidi yale ya awali. Pia linaibua wasiwasi kwa keki za `__Secure-` na `__Host-` katika muktadha usio salama na linaweza kusababisha kupita kwa mamlaka wakati keki zinapopelekwa kwa seva za nyuma zinazoweza kudanganywa.
 
-### Cookies $version
+### Keki $version
 
 #### Kupita WAF
 
-Kulingana na [**hiki blogpost**](https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie), inaweza kuwa inawezekana kutumia sifa ya cookie **`$Version=1`** ili kufanya backend itumie mantiki ya zamani kufafanua cookie kutokana na **RFC2109**. Zaidi ya hayo, thamani nyingine kama **`$Domain`** na **`$Path`** zinaweza kutumika kubadilisha tabia ya backend na cookie.
+Kulingana na [**hiki blogpost**](https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie), inaweza kuwa inawezekana kutumia sifa ya keki **`$Version=1`** ili kufanya backend itumie mantiki ya zamani kufafanua keki kutokana na **RFC2109**. Zaidi ya hayo, thamani nyingine kama **`$Domain`** na **`$Path`** zinaweza kutumika kubadilisha tabia ya backend na keki.
 
-#### Shambulio la Sandwich ya Cookie
+#### Shambulio la Keki Sandwich
 
-Kulingana na [**hiki blogpost**](https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique) inawezekana kutumia mbinu ya sandwich ya cookie kuiba cookies za HttpOnly. Hizi ndizo mahitaji na hatua:
+Kulingana na [**hiki blogpost**](https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique) inawezekana kutumia mbinu ya keki sandwich kuiba keki za HttpOnly. Hizi ndizo mahitaji na hatua:
 
-- Pata mahali ambapo **cookie isiyo na maana inaonyeshwa katika jibu**
-- **Unda cookie inayoitwa `$Version`** yenye thamani `1` (unaweza kufanya hivi katika shambulio la XSS kutoka JS) yenye njia maalum ili ipate nafasi ya awali (mifumo mingine kama python haitaji hatua hii)
-- **Unda cookie inayonyeshwa** yenye thamani inayowacha **nukta mbili wazi** na yenye njia maalum ili iwe katika hifadhidata ya cookie baada ya ile ya awali (`$Version`)
-- Kisha, cookie halali itafuata katika mpangilio
-- **Unda cookie ya dummy inayofunga nukta mbili** ndani ya thamani yake
+- Pata mahali ambapo **keki isiyo na maana inarejelewa katika jibu**
+- **Unda keki inayoitwa `$Version`** yenye thamani `1` (unaweza kufanya hivi katika shambulio la XSS kutoka JS) yenye njia maalum ili ipate nafasi ya awali (mifumo mingine kama python haitahitaji hatua hii)
+- **Unda keki inayorejelewa** yenye thamani inayowacha **nukuu mbili wazi** na yenye njia maalum ili iwe katika hifadhidata ya keki baada ya ile ya awali (`$Version`)
+- Kisha, keki halali itafuata katika mpangilio
+- **Unda keki ya dummy inayofunga nukuu mbili** ndani ya thamani yake
 
-Kwa njia hii, cookie ya mwathirika inakwama ndani ya toleo jipya la cookie 1 na itajitokeza kila wakati inapoonyeshwa. 
-e.g. kutoka kwa chapisho:
+Kwa njia hii, keki ya mwathirika inakwama ndani ya keki mpya toleo 1 na itarejelewa kila wakati inaporejelewa.
 ```javascript
 document.cookie = `$Version=1;`;
 document.cookie = `param1="start`;
@@ -220,11 +219,11 @@ Hii parsing inaonyesha kuondoa uakifishaji wa thamani ndani ya cookies, hivyo "\
 
 #### Bypassing cookie-name blocklists
 
-Katika RFC2109 inabainishwa kwamba **comma inaweza kutumika kama separator kati ya thamani za cookie**. Na pia inawezekana kuongeza **nafasi na tabs kabla na baada ya alama ya sawa**. Hivyo cookie kama `$Version=1; foo=bar, abc = qux` haisababishi cookie `"foo":"bar, admin = qux"` bali cookies `foo":"bar"` na `"admin":"qux"`. Angalia jinsi cookies 2 zinavyoundwa na jinsi admin ilivyondolewa nafasi kabla na baada ya alama ya sawa.
+Katika RFC2109 inabainishwa kuwa **koma inaweza kutumika kama separator kati ya thamani za cookie**. Na pia inawezekana kuongeza **nafasi na tab kabla na baada ya alama ya sawa**. Hivyo cookie kama `$Version=1; foo=bar, abc = qux` haisababishi cookie `"foo":"bar, admin = qux"` bali cookies `foo":"bar"` na `"admin":"qux"`. Angalia jinsi cookies 2 zinavyoundwa na jinsi admin alivyondolewa nafasi kabla na baada ya alama ya sawa.
 
 #### Bypassing value analysis with cookie splitting
 
-Hatimaye backdoors tofauti zingeungana katika string cookies tofauti zilizopitishwa katika vichwa tofauti vya cookie kama katika:
+Hatimaye backdoors tofauti zingeunganishwa katika string cookies tofauti zilizopitishwa katika vichwa tofauti vya cookie kama katika:
 ```
 GET / HTTP/1.1
 Host: example.com
@@ -252,9 +251,9 @@ Resulting cookie: name=eval('test//, comment') => allowed
 
 #### **Advanced cookies attacks**
 
-Ikiwa keki inabaki kuwa ile ile (au karibu) unapoingia, hii huenda ikamaanisha kwamba keki inahusiana na uwanja fulani wa akaunti yako (huenda jina la mtumiaji). Kisha unaweza:
+Ikiwa keki inabaki kuwa ile ile (au karibu) unapoingia, hii huenda ikamaanisha kwamba keki inahusiana na uwanja fulani wa akaunti yako (labda jina la mtumiaji). Kisha unaweza:
 
-- Jaribu kuunda **akaunti** nyingi zikiwa na majina ya mtumiaji yanayofanana sana na jaribu **kukisia** jinsi algorithimu inavyofanya kazi.
+- Jaribu kuunda akaunti nyingi zikiwa na majina ya mtumiaji yanayofanana sana na jaribu **kukisia** jinsi algorithimu inavyofanya kazi.
 - Jaribu **bruteforce jina la mtumiaji**. Ikiwa keki inahifadhiwa tu kama njia ya uthibitishaji kwa jina lako la mtumiaji, basi unaweza kuunda akaunti yenye jina la mtumiaji "**Bmin**" na **bruteforce** kila **bit** ya keki yako kwa sababu moja ya keki ambazo utajaribu itakuwa ile inayomilikiwa na "**admin**".
 - Jaribu **Padding** **Oracle** (unaweza kufichua maudhui ya keki). Tumia **padbuster**.
 
@@ -270,9 +269,9 @@ padBuster http://web.com/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28E
 ```
 Padbuster itafanya majaribio kadhaa na itakuuliza ni hali ipi ndiyo hali ya makosa (ile ambayo si halali).
 
-Kisha itaanza kufichua cookie (inaweza kuchukua dakika kadhaa)
+Kisha itaanza kufungua siri cookie (inaweza kuchukua dakika kadhaa)
 
-Ikiwa shambulio limefanikiwa, basi unaweza kujaribu kuficha mfuatano wa chaguo lako. Kwa mfano, ikiwa ungependa **encrypt** **user=administrator**
+Ikiwa shambulio limefanywa kwa mafanikio, basi unaweza kujaribu kuandika upya mfuatano wa chaguo lako. Kwa mfano, ikiwa ungependa **kuandika upya** **user=administrator**
 ```
 padbuster http://web.com/index.php 1dMjA5hfXh0jenxJQ0iW6QXKkzAGIWsiDAKV3UwJPT2lBP+zAD0D0w== 8 -cookies thecookie=1dMjA5hfXh0jenxJQ0iW6QXKkzAGIWsiDAKV3UwJPT2lBP+zAD0D0w== -plaintext user=administrator
 ```
@@ -291,15 +290,15 @@ Labda cookie inaweza kuwa na thamani fulani na inaweza kusainiwa kwa kutumia CBC
 **ECB**
 
 Ikiwa cookie imefungwa kwa kutumia ECB inaweza kuwa na hatari.\
-Wakati unapoingia, cookie unayopokea inapaswa kuwa kila wakati sawa.
+Unapojisajili, cookie unayopokea inapaswa kuwa kila wakati sawa.
 
 **Jinsi ya kugundua na kushambulia:**
 
-Unda watumiaji 2 wenye takwimu karibu sawa (jina la mtumiaji, nenosiri, barua pepe, nk.) na jaribu kugundua muundo wowote ndani ya cookie iliyotolewa.
+Unda watumiaji 2 wenye takwimu karibu sawa (jina la mtumiaji, nywila, barua pepe, nk.) na jaribu kugundua muundo wowote ndani ya cookie iliyotolewa.
 
-Unda mtumiaji anayeitwa kwa mfano "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" na angalia ikiwa kuna muundo wowote katika cookie (kama ECB inasimbwa kwa kutumia funguo sawa kila block, bytes sawa zilizofungwa zinaweza kuonekana ikiwa jina la mtumiaji linapofungwa).
+Unda mtumiaji anayeitwa kwa mfano "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" na angalia ikiwa kuna muundo wowote katika cookie (kama ECB inasimbwa kwa kutumia funguo sawa kila block, bytes sawa zilizofungwa zinaweza kuonekana ikiwa jina la mtumiaji linapangiliwa).
 
-Inapaswa kuwa na muundo (kwa ukubwa wa block inayotumika). Hivyo, ukijua jinsi kundi la "a" linavyosimbwa unaweza kuunda jina la mtumiaji: "a"\*(ukubwa wa block)+"admin". Kisha, unaweza kufuta muundo wa funguo wa block ya "a" kutoka kwa cookie. Na utakuwa na cookie ya jina la mtumiaji "admin".
+Inapaswa kuwa na muundo (ukubwa wa block inayotumika). Hivyo, ukijua jinsi kundi la "a" linavyosimbwa unaweza kuunda jina la mtumiaji: "a"\*(ukubwa wa block)+"admin". Kisha, unaweza kufuta muundo wa kusimbwa wa block ya "a" kutoka kwa cookie. Na utakuwa na cookie ya jina la mtumiaji "admin".
 
 ## Marejeo
 

theme/ai.js

@@ -1,27 +1,28 @@
 /**
- * HackTricks AI Chat Widget v1.15 – Markdown rendering + sanitised
- * ------------------------------------------------------------------------
- * • Replaces the static “…” placeholder with a three-dot **bouncing** loader
- * • Renders assistant replies as Markdown while purging any unsafe HTML
- *   (XSS-safe via DOMPurify)
- * ------------------------------------------------------------------------
+ * HackTricks AI Chat Widget v1.16 – resizable sidebar
+ * ---------------------------------------------------
+ * ❶ Markdown rendering + sanitised (same as before)
+ * ❷ NEW: drag‑to‑resize panel, width persists via localStorage
  */
 (function () {
-  const LOG = "[HackTricks-AI]";
-
-  /* ---------------- User-tunable constants ---------------- */
-  const MAX_CONTEXT  = 3000;     // highlighted-text char limit
-  const MAX_QUESTION = 500;      // question char limit
+  const LOG = "[HackTricks‑AI]";
+  /* ---------------- User‑tunable constants ---------------- */
+  const MAX_CONTEXT  = 3000;   // highlighted‑text char limit
+  const MAX_QUESTION = 500;    // question char limit
+  const MIN_W        = 250;    // ← resize limits →
+  const MAX_W        = 600;
+  const DEF_W        = 350;    // default width (if nothing saved)
   const TOOLTIP_TEXT =
-    "💡 Highlight any text on the page,\nthen click to ask HackTricks AI about it";
+    "💡 Highlight any text on the page,\nthen click to ask HackTricks AI about it";
 
   const API_BASE  = "https://www.hacktricks.ai/api/assistants/threads";
-  const BRAND_RED = "#b31328"; // HackTricks brand
+  const BRAND_RED = "#b31328";
 
   /* ------------------------------ State ------------------------------ */
   let threadId  = null;
   let isRunning = false;
 
+  /* ---------- helpers ---------- */
   const $ = (sel, ctx = document) => ctx.querySelector(sel);
   if (document.getElementById("ht-ai-btn")) {
     console.warn(`${LOG} Widget already injected.`);
@@ -31,44 +32,37 @@
     ? document.addEventListener("DOMContentLoaded", init)
     : init());
 
-  /* ==================================================================== */
-  /*  🔗 1. 3rd-party libs → Markdown & sanitiser                         */
-  /* ==================================================================== */
+  /* =================================================================== */
+  /*  🔗 1. 3rd‑party libs → Markdown & sanitiser                        */
+  /* =================================================================== */
   function loadScript(src) {
-    return new Promise((resolve, reject) => {
+    return new Promise((res, rej) => {
       const s = document.createElement("script");
       s.src = src;
-      s.onload = resolve;
-      s.onerror = () => reject(new Error(`Failed to load ${src}`));
+      s.onload = res;
+      s.onerror = () => rej(new Error(`Failed to load ${src}`));
       document.head.appendChild(s);
     });
   }
-
   async function ensureDeps() {
     const deps = [];
-    if (typeof marked === "undefined") {
+    if (typeof marked === "undefined")
       deps.push(loadScript("https://cdn.jsdelivr.net/npm/marked/marked.min.js"));
-    }
-    if (typeof DOMPurify === "undefined") {
+    if (typeof DOMPurify === "undefined")
       deps.push(
         loadScript(
           "https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.2.5/purify.min.js"
         )
       );
-    }
     if (deps.length) await Promise.all(deps);
   }
+  const mdToSafeHTML = (md) =>
+    DOMPurify.sanitize(marked.parse(md, { mangle: false, headerIds: false }), {
+      USE_PROFILES: { html: true }
+    });
 
-  function mdToSafeHTML(md) {
-    // 1️⃣ Markdown → raw HTML
-    const raw = marked.parse(md, { mangle: false, headerIds: false });
-    // 2️⃣ Purify
-    return DOMPurify.sanitize(raw, { USE_PROFILES: { html: true } });
-  }
-
-  /* ==================================================================== */
+  /* =================================================================== */
   async function init() {
-    /* ----- make sure marked & DOMPurify are ready before anything else */
     try {
       await ensureDeps();
     } catch (e) {
@@ -76,14 +70,14 @@
       return;
     }
 
-    console.log(`${LOG} Injecting widget… v1.15`);
+    console.log(`${LOG} Injecting widget… v1.16`);
 
     await ensureThreadId();
     injectStyles();
 
     const btn      = createFloatingButton();
     createTooltip(btn);
-    const panel    = createSidebar();
+    const panel    = createSidebar();             // ← panel with resizer
     const chatLog  = $("#ht-ai-chat");
     const sendBtn  = $("#ht-ai-send");
     const inputBox = $("#ht-ai-question");
@@ -100,15 +94,8 @@
     function addMsg(text, cls) {
       const b = document.createElement("div");
       b.className = `ht-msg ${cls}`;
-
-      // ✨ assistant replies rendered as Markdown + sanitised
-      if (cls === "ht-ai") {
-        b.innerHTML = mdToSafeHTML(text);
-      } else {
-        // user / context bubbles stay plain-text
-        b.textContent = text;
-      }
-
+      b[cls === "ht-ai" ? "innerHTML" : "textContent"] =
+        cls === "ht-ai" ? mdToSafeHTML(text) : text;
       chatLog.appendChild(b);
       chatLog.scrollTop = chatLog.scrollHeight;
       return b;
@@ -116,30 +103,28 @@
     const LOADER_HTML =
       '<span class="ht-loading"><span></span><span></span><span></span></span>';
 
-    function setInputDisabled(d) {
+    const setInputDisabled = (d) => {
       inputBox.disabled = d;
       sendBtn.disabled  = d;
-    }
-    function clearThreadCookie() {
+    };
+    const clearThreadCookie = () => {
       document.cookie = "threadId=; Path=/; Max-Age=0";
-      threadId        = null;
-    }
-    function resetConversation() {
+      threadId = null;
+    };
+    const resetConversation = () => {
       chatLog.innerHTML = "";
       clearThreadCookie();
       panel.classList.remove("open");
-    }
+    };
 
     /* ------------------- Panel open / close ------------------- */
     btn.addEventListener("click", () => {
       if (!savedSelection) {
-        alert("Please highlight some text first to then ask HackTricks AI about it.");
+        alert("Please highlight some text first.");
         return;
       }
       if (savedSelection.length > MAX_CONTEXT) {
-        alert(
-          `Highlighted text is too long (${savedSelection.length} chars). Max allowed: ${MAX_CONTEXT}.`
-        );
+        alert(`Highlighted text is too long. Max ${MAX_CONTEXT} chars.`);
         return;
       }
       chatLog.innerHTML = "";
@@ -157,11 +142,10 @@
         addMsg("Please wait until the current operation completes.", "ht-ai");
         return;
       }
-
       isRunning = true;
       setInputDisabled(true);
-      const loadingBubble = addMsg("", "ht-ai");
-      loadingBubble.innerHTML = LOADER_HTML;
+      const loading = addMsg("", "ht-ai");
+      loading.innerHTML = LOADER_HTML;
 
       const content = context
         ? `### Context:\n${context}\n\n### Question to answer:\n${question}`
@@ -178,43 +162,39 @@
           try {
             const e = await res.json();
             if (e.error) err = `Error: ${e.error}`;
-            else if (res.status === 429)
-              err = "Rate limit exceeded. Please try again later.";
+            else if (res.status === 429) err = "Rate limit exceeded.";
           } catch (_) {}
-          loadingBubble.textContent = err;
+          loading.textContent = err;
           return;
         }
         const data = await res.json();
-        loadingBubble.remove();
+        loading.remove();
         if (Array.isArray(data.response))
-          data.response.forEach((p) => {
+          data.response.forEach((p) =>
             addMsg(
               p.type === "text" && p.text && p.text.value
                 ? p.text.value
                 : JSON.stringify(p),
               "ht-ai"
-            );
-          });
+            )
+          );
         else if (typeof data.response === "string")
           addMsg(data.response, "ht-ai");
         else addMsg(JSON.stringify(data, null, 2), "ht-ai");
       } catch (e) {
         console.error("Error sending message:", e);
-        loadingBubble.textContent = "An unexpected error occurred.";
+        loading.textContent = "An unexpected error occurred.";
       } finally {
         isRunning = false;
         setInputDisabled(false);
         chatLog.scrollTop = chatLog.scrollHeight;
       }
     }
-
     async function handleSend() {
       const q = inputBox.value.trim();
       if (!q) return;
       if (q.length > MAX_QUESTION) {
-        alert(
-          `Your question is too long (${q.length} chars). Max allowed: ${MAX_QUESTION}.`
-        );
+        alert(`Question too long (${q.length}). Max ${MAX_QUESTION}.`);
         return;
       }
       inputBox.value = "";
@@ -228,9 +208,9 @@
         handleSend();
       }
     });
-  }
+  } /* end init */
 
-  /* ==================================================================== */
+  /* =================================================================== */
   async function ensureThreadId() {
     const m = document.cookie.match(/threadId=([^;]+)/);
     if (m && m[1]) {
@@ -241,62 +221,67 @@
       const r = await fetch(API_BASE, { method: "POST", credentials: "include" });
       const d = await r.json();
       if (!r.ok || !d.threadId) throw new Error(`${r.status} ${r.statusText}`);
-      threadId       = d.threadId;
+      threadId = d.threadId;
       document.cookie =
         `threadId=${threadId}; Path=/; Secure; SameSite=Strict; Max-Age=7200`;
     } catch (e) {
       console.error("Error creating threadId:", e);
-      alert("Failed to initialise the conversation. Please refresh and try again.");
+      alert("Failed to initialise the conversation. Please refresh.");
       throw e;
     }
   }
 
-  /* ==================================================================== */
+  /* =================================================================== */
   function injectStyles() {
     const css = `
-        #ht-ai-btn{position:fixed;bottom:20px;left:50%;transform:translateX(-50%);width:60px;height:60px;border-radius:50%;background:#1e1e1e;color:#fff;font-size:28px;display:flex;align-items:center;justify-content:center;cursor:pointer;z-index:99999;box-shadow:0 2px 8px rgba(0,0,0,.4);transition:opacity .2s}
-        #ht-ai-btn:hover{opacity:.85}
-        @media(max-width:768px){#ht-ai-btn{display:none}}
-        #ht-ai-tooltip{position:fixed;padding:6px 8px;background:#111;color:#fff;border-radius:4px;font-size:13px;white-space:pre-wrap;pointer-events:none;opacity:0;transform:translate(-50%,-8px);transition:opacity .15s ease,transform .15s ease;z-index:100000}
-        #ht-ai-tooltip.show{opacity:1;transform:translate(-50%,-12px)}
-        #ht-ai-panel{position:fixed;top:0;right:0;height:100%;width:350px;max-width:90vw;background:#000;color:#fff;display:flex;flex-direction:column;transform:translateX(100%);transition:transform .3s ease;z-index:100000;font-family:system-ui,-apple-system,Segoe UI,Roboto,"Helvetica Neue",Arial,sans-serif}
-        #ht-ai-panel.open{transform:translateX(0)}
-        @media(max-width:768px){#ht-ai-panel{display:none}}
-        #ht-ai-header{display:flex;justify-content:space-between;align-items:center;padding:12px 16px;border-bottom:1px solid #333}
-        #ht-ai-header .ht-actions{display:flex;gap:8px;align-items:center}
-        #ht-ai-close,#ht-ai-reset{cursor:pointer;font-size:18px;background:none;border:none;color:#fff;padding:0}
-        #ht-ai-close:hover,#ht-ai-reset:hover{opacity:.7}
-        #ht-ai-chat{flex:1;overflow-y:auto;padding:16px;display:flex;flex-direction:column;gap:12px;font-size:14px}
-        .ht-msg{max-width:90%;line-height:1.4;padding:10px 12px;border-radius:8px;white-space:pre-wrap;word-wrap:break-word}
-        .ht-user{align-self:flex-end;background:${BRAND_RED}}
-        .ht-ai{align-self:flex-start;background:#222}
-        .ht-context{align-self:flex-start;background:#444;font-style:italic;font-size:13px}
-        #ht-ai-input{display:flex;gap:8px;padding:12px 16px;border-top:1px solid #333}
-        #ht-ai-question{flex:1;min-height:40px;max-height:120px;resize:vertical;padding:8px;border-radius:6px;border:none;font-size:14px}
-        #ht-ai-send{padding:0 18px;border:none;border-radius:6px;background:${BRAND_RED};color:#fff;font-size:14px;cursor:pointer}
-        #ht-ai-send:disabled{opacity:.5;cursor:not-allowed}
-        /* Loader animation */
-        .ht-loading{display:inline-flex;align-items:center;gap:4px}
-        .ht-loading span{width:6px;height:6px;border-radius:50%;background:#888;animation:ht-bounce 1.2s infinite ease-in-out}
-        .ht-loading span:nth-child(2){animation-delay:0.2s}
-        .ht-loading span:nth-child(3){animation-delay:0.4s}
-        @keyframes ht-bounce{0%,80%,100%{transform:scale(0);}40%{transform:scale(1);} }
-        ::selection{background:#ffeb3b;color:#000}
-        ::-moz-selection{background:#ffeb3b;color:#000}`;
+#ht-ai-btn{position:fixed;bottom:20px;left:50%;transform:translateX(-50%);min-width:60px;height:60px;border-radius:30px;background:linear-gradient(45deg, #b31328, #d42d3f, #2d5db4, #3470e4);background-size:300% 300%;animation:gradientShift 8s ease infinite;color:#fff;font-size:18px;display:flex;align-items:center;justify-content:center;cursor:pointer;z-index:99999;box-shadow:0 2px 8px rgba(0,0,0,.4);transition:opacity .2s;padding:0 20px}
+#ht-ai-btn span{margin-left:8px;font-weight:bold}
+@keyframes gradientShift{0%{background-position:0% 50%}50%{background-position:100% 50%}100%{background-position:0% 50%}}
+#ht-ai-btn:hover{opacity:.85}
+@media(max-width:768px){#ht-ai-btn{display:none}}
+#ht-ai-tooltip{position:fixed;padding:6px 8px;background:#111;color:#fff;border-radius:4px;font-size:13px;white-space:pre-wrap;pointer-events:none;opacity:0;transform:translate(-50%,-8px);transition:opacity .15s ease,transform .15s ease;z-index:100000}
+#ht-ai-tooltip.show{opacity:1;transform:translate(-50%,-12px)}
+#ht-ai-panel{position:fixed;top:0;right:0;height:100%;max-width:90vw;background:#000;color:#fff;display:flex;flex-direction:column;transform:translateX(100%);transition:transform .3s ease;z-index:100000;font-family:system-ui,-apple-system,Segoe UI,Roboto,"Helvetica Neue",Arial,sans-serif}
+#ht-ai-panel.open{transform:translateX(0)}
+@media(max-width:768px){#ht-ai-panel{display:none}}
+#ht-ai-header{display:flex;justify-content:space-between;align-items:center;padding:12px 16px;border-bottom:1px solid #333}
+#ht-ai-header .ht-actions{display:flex;gap:8px;align-items:center}
+#ht-ai-close,#ht-ai-reset{cursor:pointer;font-size:18px;background:none;border:none;color:#fff;padding:0}
+#ht-ai-close:hover,#ht-ai-reset:hover{opacity:.7}
+#ht-ai-chat{flex:1;overflow-y:auto;padding:16px;display:flex;flex-direction:column;gap:12px;font-size:14px}
+.ht-msg{max-width:90%;line-height:1.4;padding:10px 12px;border-radius:8px;white-space:pre-wrap;word-wrap:break-word}
+.ht-user{align-self:flex-end;background:${BRAND_RED}}
+.ht-ai{align-self:flex-start;background:#222}
+.ht-context{align-self:flex-start;background:#444;font-style:italic;font-size:13px}
+#ht-ai-input{display:flex;gap:8px;padding:12px 16px;border-top:1px solid #333}
+#ht-ai-question{flex:1;min-height:40px;max-height:120px;resize:vertical;padding:8px;border-radius:6px;border:none;font-size:14px}
+#ht-ai-send{padding:0 18px;border:none;border-radius:6px;background:${BRAND_RED};color:#fff;font-size:14px;cursor:pointer}
+#ht-ai-send:disabled{opacity:.5;cursor:not-allowed}
+/* Loader */
+.ht-loading{display:inline-flex;align-items:center;gap:4px}
+.ht-loading span{width:6px;height:6px;border-radius:50%;background:#888;animation:ht-bounce 1.2s infinite ease-in-out}
+.ht-loading span:nth-child(2){animation-delay:0.2s}
+.ht-loading span:nth-child(3){animation-delay:0.4s}
+@keyframes ht-bounce{0%,80%,100%{transform:scale(0);}40%{transform:scale(1);} }
+::selection{background:#ffeb3b;color:#000}
+::-moz-selection{background:#ffeb3b;color:#000}
+/* NEW: resizer handle */
+#ht-ai-resizer{position:absolute;left:0;top:0;width:6px;height:100%;cursor:ew-resize;background:transparent}
+#ht-ai-resizer:hover{background:rgba(255,255,255,.05)}`;
     const s = document.createElement("style");
     s.id = "ht-ai-style";
     s.textContent = css;
     document.head.appendChild(s);
   }
 
+  /* =================================================================== */
   function createFloatingButton() {
     const d = document.createElement("div");
     d.id = "ht-ai-btn";
-    d.textContent = "🤖";
+    d.innerHTML = "🤖<span>HackTricksAI</span>";
     document.body.appendChild(d);
     return d;
   }
-
   function createTooltip(btn) {
     const t = document.createElement("div");
     t.id = "ht-ai-tooltip";
@@ -311,11 +296,16 @@
     btn.addEventListener("mouseleave", () => t.classList.remove("show"));
   }
 
+  /* =================================================================== */
   function createSidebar() {
+    const saved = parseInt(localStorage.getItem("htAiWidth") || DEF_W, 10);
+    const width = Math.min(Math.max(saved, MIN_W), MAX_W);
+
     const p = document.createElement("div");
     p.id = "ht-ai-panel";
+    p.style.width = width + "px";               // ← applied width
     p.innerHTML = `
-      <div id="ht-ai-header"><strong>HackTricks AI Chat</strong>
+      <div id="ht-ai-header"><strong>HackTricks AI Chat</strong>
         <div class="ht-actions">
           <button id="ht-ai-reset" title="Reset">↺</button>
           <span id="ht-ai-close" title="Close">✖</span>
@@ -326,7 +316,39 @@
         <textarea id="ht-ai-question" placeholder="Type your question…"></textarea>
         <button id="ht-ai-send">Send</button>
       </div>`;
+    /* NEW: resizer strip */
+    const resizer = document.createElement("div");
+    resizer.id = "ht-ai-resizer";
+    p.appendChild(resizer);
     document.body.appendChild(p);
+    addResizeLogic(resizer, p);
     return p;
   }
+
+  /* ---------------- resize behaviour ---------------- */
+  function addResizeLogic(handle, panel) {
+    let startX, startW, dragging = false;
+
+    const onMove = (e) => {
+      if (!dragging) return;
+      const dx = startX - e.clientX;           // dragging leftwards ⇒ +dx
+      let newW = startW + dx;
+      newW = Math.min(Math.max(newW, MIN_W), MAX_W);
+      panel.style.width = newW + "px";
+    };
+    const onUp = () => {
+      if (!dragging) return;
+      dragging = false;
+      localStorage.setItem("htAiWidth", parseInt(panel.style.width, 10));
+      document.removeEventListener("mousemove", onMove);
+      document.removeEventListener("mouseup", onUp);
+    };
+    handle.addEventListener("mousedown", (e) => {
+      dragging = true;
+      startX = e.clientX;
+      startW = parseInt(window.getComputedStyle(panel).width, 10);
+      document.addEventListener("mousemove", onMove);
+      document.addEventListener("mouseup", onUp);
+    });
+  }
 })();