# The Hack Sparrow > Hacking writeups, tools, cheatsheets and bug bounty. Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context. Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`). ## Pages - [About this site](https://thehacksparrow.com/about.md) - Hacksparr0w▌Offensive security & GRC. I break things on HTB, write about how, and automate the repetitive parts with my own tools.GitHub →Hack The Box →LinkedIn →Telegram → The Hack Sparrow is my offensive security notebook: machine writeups, CTF challenges, and bug bounty findings. Here I explain… - [Account](https://thehacksparrow.com/account.md) - [Active Directory](https://thehacksparrow.com/active-directory.md) - [Contact](https://thehacksparrow.com/contact.md) - [CPTS](https://thehacksparrow.com/cpts.md) - [eCPPT](https://thehacksparrow.com/ecppt.md) - [eJPT](https://thehacksparrow.com/ejpt.md) - [Starting from Zero](https://thehacksparrow.com/empezar-de-cero.md) - [Linux Privesc](https://thehacksparrow.com/linux-privesc.md) - [Membership](https://thehacksparrow.com/membership.md) - The Hack Sparrow ofrece contenido abierto y contenido exclusivo para miembros. Gratis Acceso a los writeups y recursos públicos del sitio. Miembro Acceso completo a writeups premium, técnicas avanzadas y reportes detallados de bug bounty. Los planes y precios estarán disponibles muy pronto. - [OSCP](https://thehacksparrow.com/oscp.md) - [OSEP](https://thehacksparrow.com/osep.md) - [OSWE](https://thehacksparrow.com/oswe.md) - [Privacy Policy](https://thehacksparrow.com/privacy.md) - Last updated: 27 July 2026 1. Data controller * Legal name: Roberto Bou Poveda, trading as “The Hack Sparrow” (sole trader / autónomo under Spanish law — not a separate registered company) * Tax ID (NIF): 46991671A * Address: Calle Unic nº 7, 25798 Calbinyà, Les Valls del Valira, Lleida, Spain * Bu… - [Refund Policy](https://thehacksparrow.com/refund-policy.md) - Last updated: 27 July 2026 1. If you're in the EU: your 14-day right of withdrawal As a consumer in the European Union, you normally have the right to withdraw from an online purchase within 14 days, without giving a reason, and get a full refund. For digital content like Root Access — where you ge… - [Roadmaps](https://thehacksparrow.com/roadmaps.md) - Curated study roadmaps for OSCP, OSEP, OSWE, CPTS, eCPPT, eJPT and skill-based tracks (Active Directory, Linux/Windows privesc, web exploitation), each mapped to real HackTheBox machines with write-ups as you unlock them. This page is under construction — the full roadmap grid is coming soon. Roadm… - [Sign In](https://thehacksparrow.com/signin.md) - [Terms of Service](https://thehacksparrow.com/terms.md) - Last updated: 27 July 2026 1. Who we are The Hack Sparrow is operated by: * Legal name: Roberto Bou Poveda, trading as “The Hack Sparrow” (sole trader / autónomo under Spanish law — “The Hack Sparrow” is this website's brand name, not a separate registered company; the party you contract with is th… - [Web Exploitation](https://thehacksparrow.com/web-exploitation.md) - [Windows Privesc](https://thehacksparrow.com/windows-privesc.md) ## Posts - [DanglingTree](https://thehacksparrow.com/danglingtree.md) - Active machine — the writeup will be published once DanglingTree retires. - [Cohort](https://thehacksparrow.com/cohort.md) - Active machine — the writeup will be published once Cohort retires. - [DarkZeroReturns](https://thehacksparrow.com/darkzeroreturns.md) - Active machine — the writeup will be published once DarkZeroReturns retires. - [GraphQL Misconfiguration](https://thehacksparrow.com/vulnerability-pattern-graphql.md) - Introspection left wide open, and mutations that skip the checks their REST equivalents would have. - [WAF Bypass](https://thehacksparrow.com/vulnerability-pattern-waf-bypass.md) - The underlying bug was never fixed — the WAF just learned to block the obvious version of the payload. - [Business Logic Abuse](https://thehacksparrow.com/vulnerability-pattern-business-logic.md) - No injection, no exploit — just doing the flow in an order, combination or value range the business rules never anticipated. - [Path Traversal / LFI](https://thehacksparrow.com/vulnerability-pattern-path-traversal.md) - Reading files the application never meant to expose, by manipulating a file path parameter. - [SSRF](https://thehacksparrow.com/vulnerability-pattern-ssrf.md) - Getting the server itself to fetch a URL you control — where it hides and how to prove it safely. - [Cache Poisoning & Cache Deception](https://thehacksparrow.com/vulnerability-pattern-cache.md) - One poisoned response can hit every visitor to a URL; cache deception can leak one victim's private data to anyone who knows the trick. - [Open Redirect](https://thehacksparrow.com/vulnerability-pattern-open-redirect.md) - Why 'it's just a redirect' undersells it, and the whitelist/Referer bypasses that make it worth reporting. - [SQL Injection](https://thehacksparrow.com/vulnerability-pattern-sqli.md) - From a single quote that breaks a page to blind, time-based data exfiltration — how I confirm it's real before touching anything sensitive. - [OAuth & Authentication Flaws](https://thehacksparrow.com/vulnerability-pattern-oauth-auth.md) - Account takeover through broken password reset and session handling, and OAuth redirect_uri hijacking — the two roads to the same destination. - [IDOR & Broken Access Control](https://thehacksparrow.com/vulnerability-pattern-idor-bac.md) - Two sides of the same coin: reading someone else's data by changing an ID, or performing an action your role was never meant to allow. - [XSS](https://thehacksparrow.com/vulnerability-pattern-xss.md) - How I think about stored and reflected XSS — where it hides, how to confirm persistence, and what actually makes it worth reporting. - [The Report Template I Actually Use](https://thehacksparrow.com/bug-bounty-report-template.md) - Two versions — quick and full — of the exact report structure I submit bug bounty findings with, section by section. - [Bug Bounty Cheatsheet: My Curated Resource Collection](https://thehacksparrow.com/bug-bounty-cheatsheet.md) - My working bookmarks list for bug bounty hunting — recon, exploitation techniques, checklists and tools, organized by topic. - [My Real Bug Bounty Workflow (Day by Day)](https://thehacksparrow.com/bug-bounty-workflow.md) - Target selection, recon, the actual attack order I follow, and the weekly ramp-up plan — my real process, not a generic methodology. - [OWASP-Style Web Vulnerabilities, Explained](https://thehacksparrow.com/owasp-vulnerabilities-explained.md) - A plain-English tour of the vulnerability classes you'll run into constantly in bug bounty hunting — what each one is, where to look, and why it matters. - [Bug Bounty Hub: what's inside this section](https://thehacksparrow.com/bug-bounty-overview.md) - An index of everything in /bug-bounty/ — an OWASP-style vulnerability primer, my real day-to-day hunting workflow, report template, and pattern breakdowns, all behind Root Access. - [Build the Perfect Rescue USB](https://thehacksparrow.com/guia-usb-de-rescate.md) - How to build one Ventoy-based USB that handles boot repair, malware cleanup, RAM testing, and file recovery — no need for five separate drives. - [Metasploit From Scratch](https://thehacksparrow.com/guia-metasploit.md) - How to actually think in msfconsole: module types, searching properly, picking the right payload, LHOST gotchas, and why exploits fail. - [BuiltWith](https://thehacksparrow.com/builtwith.md) - What BuiltWith is, how its historical tech-stack tracking differs from Wappalyzer, and how I use it to see a target's evolution. - [Whois](https://thehacksparrow.com/whois.md) - What Whois reveals about a domain (owner, dates, registrar), and why it's my first check on any suspicious domain. - [OSINT Framework](https://thehacksparrow.com/osint-framework.md) - What the OSINT Framework directory is, how to navigate it by category, and how it helps when you don't know which tool to reach for. - [Reverse Image Search](https://thehacksparrow.com/reverse-image-search.md) - Google, Yandex and TinEye reverse image search compared, and how I use them to verify profile photos and find image sources. - [Holehe](https://thehacksparrow.com/holehe.md) - What Holehe is, how it checks live email registration across dozens of services, and how it differs from Have I Been Pwned. - [OWASP Amass](https://thehacksparrow.com/amass.md) - What Amass is, passive vs active subdomain enumeration, and why it's my final recon pass after crt.sh and Sublist3r. - [Maltego](https://thehacksparrow.com/maltego.md) - What Maltego is, how transforms build an entity-relationship graph, and how I use it to map an organisation's surface. - [Sherlock](https://thehacksparrow.com/sherlock.md) - What Sherlock is, how to search a username across 300+ platforms, and how it complements Have I Been Pwned. - [Basic PowerShell & CMD Commands](https://thehacksparrow.com/guia-comandos-powershell.md) - A quick-reference guide to CMD and PowerShell: navigation, processes, network, and the equivalent cmdlet for each classic command. - [Basic Linux Commands](https://thehacksparrow.com/guia-comandos-linux.md) - A quick-reference guide to essential Linux commands: navigation, permissions, search, processes and networking. - [Services by Port — Enumeration & Attacks](https://thehacksparrow.com/guia-servicios-puertos.md) - A quick-reference table of what to try on every common port/service during recon, from FTP to Redis, with tools and priority. - [Google Dorking](https://thehacksparrow.com/guia-google-dorking.md) - Google Dorking guide: every useful search operator, practical combinations, and how it's used for passive recon and OSINT. - [Reset & Clean-Install Windows 11](https://thehacksparrow.com/guia-formatear-windows-11.md) - How to fully reset Windows 11: cloud vs local reinstall, and why the data-wipe option matters before selling a machine. - [Volatility](https://thehacksparrow.com/volatility.md) - Volatility 3 cheat sheet: processes, network connections, handles, DLLs, and extracting files from a memory dump. - [MongoDB](https://thehacksparrow.com/mongodb.md) - MongoDB cheat sheet: connecting without auth on 27017, browsing databases/collections, and the standard HTB flag-finding flow. - [xfreerdp](https://thehacksparrow.com/xfreerdp.md) - xfreerdp cheat sheet: connecting to Windows RDP, HTB-ready examples, and fixes for the errors you'll actually hit. - [tmux](https://thehacksparrow.com/tmux.md) - tmux cheat sheet: splitting panes, managing sessions and windows, and the shortcuts you'll actually use during an engagement. - [MySQL](https://thehacksparrow.com/mysql.md) - MySQL client cheat sheet: connecting, enumerating databases/tables, and the CRUD commands you need during an engagement. - [Wordlists (Custom Dictionaries)](https://thehacksparrow.com/wordlists.md) - Custom wordlist generators cheat sheet: CUPP, Crunch, Mentalist and CeWL for building targeted dictionaries. - [Wireshark](https://thehacksparrow.com/wireshark.md) - Wireshark cheat sheet: capture/display filters, shortcuts, finding plaintext passwords, and the Statistics tools that matter. - [vncviewer](https://thehacksparrow.com/vncviewer.md) - vncviewer cheat sheet: connecting to VNC on port 5900, and using Metasploit auxiliary modules when you don't have credentials. - [Telnet](https://thehacksparrow.com/telnet.md) - Telnet cheat sheet: connecting on port 23 and using it for manual banner grabbing against plaintext services. - [Sublist3r](https://thehacksparrow.com/sublist3r.md) - Sublist3r cheat sheet: passive subdomain enumeration via search engines, optional brute force, and how to pair it with Amass/httpx. - [smbclient](https://thehacksparrow.com/smbclient.md) - smbclient cheat sheet: connecting to SMB shares, listing servers, and the FTP-style get/put/cd/lcd commands. - [searchsploit](https://thehacksparrow.com/searchsploit.md) - searchsploit cheat sheet: offline Exploit-DB lookups by service/version, filtering with grep, and mirroring exploits locally. - [netdiscover](https://thehacksparrow.com/netdiscover.md) - netdiscover cheat sheet: find every active host on your local network via ARP before you even know a target IP. - [Metasploit](https://thehacksparrow.com/metasploit.md) - Metasploit / msfconsole cheat sheet: search, use, set, exploit, sessions and the full MS17-010 walkthrough. - [macchanger](https://thehacksparrow.com/macchanger.md) - macchanger cheat sheet: how to spoof a network interface's MAC address, randomly or to a specific value, and restore it. - [ExifTool](https://thehacksparrow.com/exiftool.md) - ExifTool cheat sheet: reading EXIF/document metadata to find GPS coordinates, authors, software and real dates. - [dirsearch](https://thehacksparrow.com/dirsearch.md) - dirsearch cheat sheet: Python-based directory/file discovery with custom wordlists, extensions and status-code filters. - [DirBuster](https://thehacksparrow.com/dirbuster.md) - DirBuster cheat sheet: GUI-based content discovery, wordlist/recursive modes, and how it compares to Gobuster. - [DNSrecon](https://thehacksparrow.com/dnsrecon.md) - DNSrecon cheat sheet: standard enumeration, subdomain brute force, AXFR zone transfers, SRV and PTR lookups. - [DNSenum](https://thehacksparrow.com/dnsenum.md) - DNSenum cheat sheet: full DNS enumeration, subdomain brute force, AXFR zone transfers and reverse lookups in one command. - [Burp Suite](https://thehacksparrow.com/burpsuite.md) - Burp Suite cheat sheet: Proxy, Repeater, Intruder, Scanner, Decoder and Comparer, with the shortcuts and setup you actually use. - [SENTINEL-GRC](https://thehacksparrow.com/sentinel-grc.md) - My own GRC maturity assessment CLI for ISO 27001, 42001 and 22301: interactive scoring, prioritised gaps, and Markdown reports. - [LAZARUS](https://thehacksparrow.com/lazarus.md) - My own Active Directory attack chain automation: AS-REP/Kerberoasting, BloodHound, ADCS ESC1-8, dMSA/BadSuccessor and Pass-the-Hash. - [BANSHEE](https://thehacksparrow.com/banshee.md) - My own Linux privilege escalation automation tool: sudo, SUID, capabilities, cron, kernel and containers, ranked by severity. - [REAPER](https://thehacksparrow.com/reaper.md) - My own recon & enumeration automation tool: nmap, web fingerprinting, subdomain hunting, and crt.sh, all in one command. - [CrackStation](https://thehacksparrow.com/crackstation.md) - What CrackStation is, its lookup-vs-bruteforce limitations, and why it's always my first try before spending local GPU time. - [LOLBAS](https://thehacksparrow.com/lolbas.md) - What LOLBAS is, how to abuse native Windows binaries for execution/download/bypass, and why it pairs with GTFOBins. - [Regex101](https://thehacksparrow.com/regex101.md) - What Regex101 is, how to debug regex patterns live across flavours, and how I use it for Burp rules and log parsing. - [CyberChef](https://thehacksparrow.com/cyberchef.md) - What CyberChef is, how to chain encode/decode operations client-side, and how I use it to deobfuscate payloads in CTFs. - [Any.run](https://thehacksparrow.com/any-run.md) - What Any.run is, how to run interactive malware analysis in the browser, and when I reach for it over VirusTotal. - [urlscan.io](https://thehacksparrow.com/urlscan.md) - What urlscan.io is, how to sandbox a suspicious URL safely, and how I use it for phishing triage in bug bounty. - [SSL Labs](https://thehacksparrow.com/ssl-labs.md) - What Qualys' SSL Labs test is, how to analyse a server's TLS configuration in depth, and how I use it for recon. - [SecurityHeaders.com](https://thehacksparrow.com/securityheaders.md) - What SecurityHeaders.com is, how it grades a site's HTTP security headers, and how I use it for quick bug bounty triage. - [Wappalyzer](https://thehacksparrow.com/wappalyzer.md) - What Wappalyzer is, how to fingerprint a site's tech stack, and why it's my first step on any web target. - [Have I Been Pwned](https://thehacksparrow.com/haveibeenpwned.md) - What Have I Been Pwned is, how to check emails/passwords against known breaches (with k-anonymity), and how I use it in engagements. - [Wayback Machine](https://thehacksparrow.com/wayback-machine.md) - What the Wayback Machine's CDX API is, how to list every archived URL for a domain, and how I use it to find forgotten endpoints. - [DNSDumpster](https://thehacksparrow.com/dnsdumpster.md) - What DNSDumpster is, how to use it for DNS/subdomain recon, and how it complements crt.sh in my bug bounty workflow. - [crt.sh](https://thehacksparrow.com/crt-sh.md) - What crt.sh is, how to query Certificate Transparency logs for subdomains, and how I use it as the first step of bug bounty recon. - [Shodan](https://thehacksparrow.com/shodan.md) - What Shodan is, how to search it (filters, host lookup), and how I use it for passive recon in bug bounty. - [VirusTotal](https://thehacksparrow.com/virustotal.md) - What VirusTotal is, how to use it (web + API, file/hash/URL scanning), and how I actually use it during CTFs and bug bounty triage. - [Medusa](https://thehacksparrow.com/medusa.md) - Medusa cheatsheet in two levels: brute-forcing services with wordlists, then combo files, cross-host parallelism, and web forms. - [hashid](https://thehacksparrow.com/hashid.md) - A two-level cheatsheet for hashid, from identifying a single hash to batch identification, Kerberos tickets and modern alternatives. - [CeWL](https://thehacksparrow.com/cewl.md) - CeWL cheatsheet across two levels: crawling a site into a targeted wordlist, then metadata harvesting, authenticated crawls and chaining into cracking tools. - [crunch](https://thehacksparrow.com/crunch.md) - A crunch cheatsheet in two levels: building custom wordlists, then driving positional patterns, on-the-fly compression and live feeds into crackers. - [PowerUp](https://thehacksparrow.com/powerup.md) - PowerUp cheatsheet in two levels: from running the automated privesc checks to weaponizing vulnerable Windows services. - [pspy](https://thehacksparrow.com/pspy.md) - A two-level pspy cheatsheet: basic process and cron monitoring, then aggressive polling, inotify watches and secret hunting. - [WinPEAS](https://thehacksparrow.com/winpeas.md) - A two-level cheatsheet for winPEAS, from basic Windows privesc enumeration to targeted credential modules and in-memory execution. - [theHarvester](https://thehacksparrow.com/theharvester.md) - A two-level theHarvester cheatsheet: basic OSINT collection of emails and subdomains, then active DNS, API sources and host enrichment. - [httpx](https://thehacksparrow.com/httpx.md) - A two-level httpx cheatsheet: fast web-alive probing and status/tech detection first, then full recon with favicon hashing, JARM and screenshots. - [Subfinder](https://thehacksparrow.com/subfinder.md) - Two levels for subfinder: from quick passive subdomain enumeration to exhaustive discovery with API keys, rate control, and chaining into other tools. - [Masscan](https://thehacksparrow.com/masscan.md) - A masscan cheatsheet across two levels: basic scans and output formats for beginners, high-rate sweeps, exclusions and banner grabbing for advanced users. - [WhatWeb](https://thehacksparrow.com/whatweb.md) - A two-level WhatWeb cheatsheet: basic tech fingerprinting for beginners and aggressive scans, proxying and structured outputs for advanced use. - [Wfuzz](https://thehacksparrow.com/wfuzz.md) - A wfuzz cheatsheet in two levels: from basic path fuzzing and response filters to vhosts, numeric ranges, encoders and expression-based filtering. - [WPScan](https://thehacksparrow.com/wpscan.md) - WPScan cheatsheet in two levels: from basic WordPress enumeration and login brute force to CVE-backed scans, stealth profiles and XML-RPC multicall. - [Feroxbuster](https://thehacksparrow.com/feroxbuster.md) - A feroxbuster cheatsheet across two levels: recursive content discovery basics, then fine-grained response filtering, authentication and scan resumption. - [Nuclei](https://thehacksparrow.com/nuclei.md) - A two-level Nuclei cheatsheet: from template-driven CVE scanning to DAST fuzzing, Burp routing and out-of-band chaining. - [msfvenom](https://thehacksparrow.com/msfvenom.md) - msfvenom payload crafting across two levels: basic payloads and output formats, then encoding, templates and advanced delivery formats. - [Ligolo-ng](https://thehacksparrow.com/ligolo-ng.md) - Ligolo-ng cheatsheet across two levels: TUN-based pivoting fundamentals and advanced internal reverse shells with double pivoting. - [Chisel](https://thehacksparrow.com/chisel.md) - A chisel cheatsheet across two levels: from reverse SOCKS proxies and port forwards to TLS transport, multi-tunnel setups and proxychains chaining. - [socat](https://thehacksparrow.com/socat.md) - A socat cheatsheet across two levels: basic listeners, relays and shells, then TLS-encrypted shells and cross-subnet pivoting. - [Netcat](https://thehacksparrow.com/netcat.md) - A Netcat/Ncat cheatsheet across two levels: listeners, file transfers and shells, then compressed transfers, disk cloning, pivoting and TLS with Ncat. - [Reverse Shells](https://thehacksparrow.com/reverse-shells.md) - A reverse shell one-liner cheatsheet across two levels: language-by-language payloads and listeners, then TTY stabilization, PowerShell and TLS-encrypted shells. - [Mimikatz](https://thehacksparrow.com/mimikatz.md) - A two-level mimikatz cheatsheet: credential dumping from LSASS, SAM and tickets, then DCSync, Golden/Silver Tickets and Pass-the-Hash. - [ldapsearch](https://thehacksparrow.com/ldapsearch.md) - A two-level ldapsearch cheatsheet: from anonymous binds and basic directory enumeration to offensive AD queries for Kerberoasting, delegation, LAPS and ACLs. - [smbmap](https://thehacksparrow.com/smbmap.md) - A two-tier SMBMAP cheatsheet: from null-session share enumeration and file access to pass-the-hash, remote execution and file hunting. - [Responder](https://thehacksparrow.com/responder.md) - Responder in two levels: from LLMNR/NBT-NS/MDNS poisoning and NetNTLMv2 capture to NTLM relay and hash downgrade. - [Certipy](https://thehacksparrow.com/certipy.md) - Certipy for AD CS, from enumerating templates and requesting certificates to full ESC exploitation chains, in two levels. - [Kerbrute](https://thehacksparrow.com/kerbrute.md) - A two-level Kerbrute cheatsheet: from Kerberos user enumeration and password spraying to opsec-aware, safe, chained attacks. - [Evil-WinRM](https://thehacksparrow.com/evil-winrm.md) - A two-level Evil-WinRM cheatsheet: from connecting and moving files over WinRM to pass-the-hash, certificate/Kerberos auth and in-memory .NET execution. - [LinPEAS](https://thehacksparrow.com/linpeas.md) - LinPEAS from download and first run to transfer tricks, output filtering and the manual checks that back it up, across two levels. - [GTFOBins](https://thehacksparrow.com/gtfobins.md) - What GTFOBins is, how to look up abusable Linux binaries for privesc, and why it's my go-to after every sudo -l. - [Impacket](https://thehacksparrow.com/impacket.md) - A two-level Impacket cheatsheet: remote shells, dumps and Kerberos roasting for beginners, DCSync, Golden Tickets and NTLM relay for advanced use. - [BloodHound](https://thehacksparrow.com/bloodhound.md) - Two levels for BloodHound: from basic Active Directory collection with SharpHound to stealth gathering and direct Cypher queries on the attack graph. - [NetExec](https://thehacksparrow.com/netexec.md) - Two-level NetExec cheatsheet: from SMB enumeration and credential validation to remote execution, NTDS/LSASS dumping and roasting. - [enum4linux](https://thehacksparrow.com/enum4linux.md) - SMB/NetBIOS enumeration with enum4linux across two levels: users, shares and password policy for beginners; enum4linux-ng with JSON/YAML output, RID cycling and rpcclient/smbclient for advanced work. - [John the Ripper](https://thehacksparrow.com/john.md) - John the Ripper across two levels: automatic hash detection and dictionary attacks for beginners, and Kerberos roasting, session control and hash extraction for advanced use. - [Hashcat](https://thehacksparrow.com/hashcat.md) - GPU password cracking with hashcat across two levels: dictionary, masks and rules for beginners; Kerberoasting, sessions and performance tuning for advanced use. - [Hydra](https://thehacksparrow.com/hydra.md) - A two-level Hydra cheatsheet: basic brute-force attacks against common services, then multi-target campaigns, resume and fine-grained tuning. - [sqlmap](https://thehacksparrow.com/sqlmap.md) - A two-level sqlmap cheatsheet: from detecting injections and dumping databases to OS shells, WAF bypass and Tor routing. - [Dirb](https://thehacksparrow.com/dirb.md) - A dirb cheatsheet in two levels: basic directory brute-forcing and advanced use with authentication, proxying and evasion. - [Nikto](https://thehacksparrow.com/nikto.md) - A Nikto cheatsheet across two levels: basic web server scanning, SSL and reports, then IDS evasion, plugins and path mutation. - [ffuf](https://thehacksparrow.com/ffuf.md) - FFUF from first hits to advanced fuzzing: filters and directories at beginner level, POST/header fuzzing, multiple wordlists and auto-calibration at advanced level. - [Gobuster](https://thehacksparrow.com/gobuster.md) - Gobuster cheatsheet across two levels: from directory, file and DNS brute-forcing to vhosts, custom auth and proxying. - [Nmap](https://thehacksparrow.com/nmap.md) - Nmap cheat sheet in two levels: host discovery, port scanning and service/OS detection for beginners; stealth scans, IP/MAC spoofing and IDS evasion for advanced users. - [Bedside](https://thehacksparrow.com/bedside.md) - Active machine — the writeup will be published once Bedside retires. - [Paperwork](https://thehacksparrow.com/paperwork.md) - Active machine — the writeup will be published once Paperwork retires. - [MakeSense](https://thehacksparrow.com/makesense.md) - Active machine — the writeup will be published once MakeSense retires. - [Enigma](https://thehacksparrow.com/enigma.md) - Active machine — the writeup will be published once Enigma retires. - [Ghostlink](https://thehacksparrow.com/ghostlink.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [Fireflow](https://thehacksparrow.com/fireflow.md) - Medium Linux machine on HackTheBox — full write-up with a free account. - [Nexus](https://thehacksparrow.com/nexus.md) - Easy Linux machine on HackTheBox — full write-up with a free account. - [Orion](https://thehacksparrow.com/orion.md) - Easy Linux machine on HackTheBox — full write-up with a free account. - [Nimbus](https://thehacksparrow.com/nimbus.md) - Active machine — the writeup will be published once Nimbus retires. - [Checkpoint](https://thehacksparrow.com/checkpoint.md) - Active machine — the writeup will be published once Checkpoint retires. - [Connected](https://thehacksparrow.com/connected.md) - Active machine — the writeup will be published once Connected retires. - [Abducted](https://thehacksparrow.com/abducted.md) - Medium Linux machine on HackTheBox — full write-up with a free account. - [DevHub](https://thehacksparrow.com/devhub.md) - Active machine — the writeup will be published once DevHub retires. - [Reactor](https://thehacksparrow.com/reactor.md) - Active machine — the writeup will be published once Reactor retires. - [SmartHire](https://thehacksparrow.com/smarthire.md) - Active machine — the writeup will be published once SmartHire retires. - [Helix](https://thehacksparrow.com/helix.md) - Active machine — the writeup will be published once Helix retires. - [PingPong](https://thehacksparrow.com/pingpong.md) - Active machine — the writeup will be published once PingPong retires. - [Logging](https://thehacksparrow.com/logging.md) - Medium Windows machine on HackTheBox — full write-up with a free account. - [Silentium](https://thehacksparrow.com/silentium.md) - Active machine — the writeup will be published once Silentium retires. - [Garfield](https://thehacksparrow.com/garfield.md) - Active machine — the writeup will be published once Garfield retires. - [DevArea](https://thehacksparrow.com/devarea.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Kobold](https://thehacksparrow.com/kobold.md) - Active machine — the writeup will be published once Kobold retires. - [Lucky Dice](https://thehacksparrow.com/lucky-dice.md) - Lucky Dice is still active on HTB — writeup locked until it retires. - [VariaType](https://thehacksparrow.com/variatype.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Principal](https://thehacksparrow.com/principal.md) - Medium Linux machine on HackTheBox — full write-up with a free account. - [CCTV](https://thehacksparrow.com/cctv.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Pirate](https://thehacksparrow.com/pirate.md) - Active machine — the writeup will be published once Pirate retires. - [WingData](https://thehacksparrow.com/wingdata.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Facts](https://thehacksparrow.com/facts.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [OpenSecret](https://thehacksparrow.com/opensecret.md) - Very Easy web challenge on HackTheBox — full write-up with a free account. - [Eloquia](https://thehacksparrow.com/eloquia.md) - Active machine — the writeup will be published once Eloquia retires. - [MonitorsFour](https://thehacksparrow.com/monitorsfour.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Fries](https://thehacksparrow.com/fries.md) - Active machine — the writeup will be published once Fries retires. - [Offensive Security Intro](https://thehacksparrow.com/offensive-security-intro.md) - Easy room on TryHackMe — full write-up with a free account. - [Eighteen](https://thehacksparrow.com/eighteen.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Conversor](https://thehacksparrow.com/conversor.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Hercules](https://thehacksparrow.com/hercules.md) - Active machine — the writeup will be published once Hercules retires. - [Pentesting Fundamentals](https://thehacksparrow.com/pentesting-fundamentals.md) - Easy room on TryHackMe — full write-up with a free account. - [Signed](https://thehacksparrow.com/signed.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [DarkZero](https://thehacksparrow.com/darkzero.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [Imagery](https://thehacksparrow.com/imagery.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [The Puppet Master](https://thehacksparrow.com/the-puppet-master.md) - The Puppet Master is still active on HTB — writeup locked until it retires. - [Expressway](https://thehacksparrow.com/expressway.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Baby](https://thehacksparrow.com/baby.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Forgotten](https://thehacksparrow.com/forgotten.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Input Manipulation & Prompt Injection](https://thehacksparrow.com/input-manipulation-prompt-injection.md) - Easy room on TryHackMe — full write-up with a free account. - [Soulmate](https://thehacksparrow.com/soulmate.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Social Media Investigation Hub](https://thehacksparrow.com/social-media-investigation.md) - Social Media Investigation Hub is still active on HTB — writeup locked until it retires. - [CodePartTwo](https://thehacksparrow.com/codeparttwo.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [The Suspicious Domain](https://thehacksparrow.com/the-suspicious-domain.md) - The Suspicious Domain is still active on HTB — writeup locked until it retires. - [AI/ML Security Threats](https://thehacksparrow.com/ai-ml-security-threats.md) - Easy room on TryHackMe — full write-up with a free account. - [Cobblestone](https://thehacksparrow.com/cobblestone.md) - Active machine — the writeup will be published once Cobblestone retires. - [The Suspicious Reviewer](https://thehacksparrow.com/the-suspicious-reviewer.md) - Very Easy osint challenge on HackTheBox — full write-up with a free account. - [Editor](https://thehacksparrow.com/editor.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Outbound](https://thehacksparrow.com/outbound.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [HealthGPT](https://thehacksparrow.com/healthgpt.md) - Easy room on TryHackMe — full write-up with a free account. - [Voleur](https://thehacksparrow.com/voleur.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Data](https://thehacksparrow.com/data.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Artificial](https://thehacksparrow.com/artificial.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [BankGPT](https://thehacksparrow.com/bankgpt.md) - Easy room on TryHackMe — full write-up with a free account. - [TombWatcher](https://thehacksparrow.com/tombwatcher.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Fluffy](https://thehacksparrow.com/fluffy.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Puppy](https://thehacksparrow.com/puppy.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Intro to Credential Harvesting](https://thehacksparrow.com/intro-to-credential-harvesting.md) - Medium Windows room on TryHackMe — full write-up with Root Access. - [Environment](https://thehacksparrow.com/environment.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Nocturnal](https://thehacksparrow.com/nocturnal.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Linux Threat Detection 1](https://thehacksparrow.com/linux-threat-detection-1.md) - Medium Linux room on TryHackMe — full write-up with Root Access. - [Haze](https://thehacksparrow.com/haze.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [Code](https://thehacksparrow.com/code.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [TheFrizz](https://thehacksparrow.com/thefrizz.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Dog](https://thehacksparrow.com/dog.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Elevating Movement](https://thehacksparrow.com/elevating-movement.md) - Hard Windows room on TryHackMe — full write-up with Root Access. - [Titanic](https://thehacksparrow.com/titanic.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [AppSec IR](https://thehacksparrow.com/appsec-ir.md) - Medium room on TryHackMe — full write-up with Root Access. - [EscapeTwo](https://thehacksparrow.com/escapetwo.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Security Footage](https://thehacksparrow.com/security-footage.md) - Medium room on TryHackMe — full write-up with Root Access. - [LinkVortex](https://thehacksparrow.com/linkvortex.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Operation Slither](https://thehacksparrow.com/operation-slither.md) - Easy room on TryHackMe — full write-up with a free account. - [Alert](https://thehacksparrow.com/alert.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [SpookyPass](https://thehacksparrow.com/spookypass.md) - Very Easy reversing challenge on HackTheBox — full write-up with a free account. - [File and Hash Threat Intel](https://thehacksparrow.com/file-and-hash-threat-intel.md) - Easy room on TryHackMe — full write-up with a free account. - [Cicada](https://thehacksparrow.com/cicada.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Malware Classification](https://thehacksparrow.com/malware-classification.md) - Easy room on TryHackMe — full write-up with a free account. - [Invite Only](https://thehacksparrow.com/invite-only.md) - Easy room on TryHackMe — full write-up with a free account. - [Introduction to EDR](https://thehacksparrow.com/introduction-to-edr.md) - Easy room on TryHackMe — full write-up with a free account. - [PermX](https://thehacksparrow.com/permx.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Editorial](https://thehacksparrow.com/editorial.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Linux Logging for SOC](https://thehacksparrow.com/linux-logging-for-soc.md) - Easy Linux room on TryHackMe — full write-up with a free account. - [Flag Command](https://thehacksparrow.com/flag-command.md) - Very Easy web challenge on HackTheBox — full write-up with a free account. - [BoardLight](https://thehacksparrow.com/boardlight.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Junior Security Analyst Intro](https://thehacksparrow.com/junior-security-analyst-intro.md) - Easy room on TryHackMe — full write-up with a free account. - [Usage](https://thehacksparrow.com/usage.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [SOC Role in Blue Team](https://thehacksparrow.com/soc-role-in-blue-team.md) - Easy room on TryHackMe — full write-up with a free account. - [Mist](https://thehacksparrow.com/mist.md) - Insane Windows machine on HackTheBox — full write-up with Root Access. - [Web Frameworks: Code Review](https://thehacksparrow.com/web-frameworks-code-review.md) - Medium room on TryHackMe — full write-up with Root Access. - [Defensive Security Intro](https://thehacksparrow.com/defensive-security-intro.md) - Easy room on TryHackMe — full write-up with a free account. - [Crypto Failures](https://thehacksparrow.com/crypto-failures.md) - Medium Linux room on TryHackMe — full write-up with Root Access. - [Chaining Vulnerabilities](https://thehacksparrow.com/chaining-vulnerabilities.md) - Easy Linux room on TryHackMe — full write-up with a free account. - [Devvortex](https://thehacksparrow.com/devvortex.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Hospital](https://thehacksparrow.com/hospital.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Broker](https://thehacksparrow.com/broker.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Manager](https://thehacksparrow.com/manager.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Session Forensics](https://thehacksparrow.com/session-forensics.md) - Medium Linux room on TryHackMe — full write-up with Root Access. - [CozyHosting](https://thehacksparrow.com/cozyhosting.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Voyage](https://thehacksparrow.com/voyage.md) - Medium Linux room on TryHackMe — full write-up with Root Access. - [Keeper](https://thehacksparrow.com/keeper.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Sneaky Patch](https://thehacksparrow.com/sneaky-patch.md) - Easy Linux room on TryHackMe — full write-up with a free account. - [Authority](https://thehacksparrow.com/authority.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Sau](https://thehacksparrow.com/sau.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Intentions](https://thehacksparrow.com/intentions.md) - Hard Linux machine on HackTheBox — full write-up with Root Access. - [Farewell](https://thehacksparrow.com/farewell.md) - Medium Linux room on TryHackMe — full write-up with Root Access. - [TwoMillion](https://thehacksparrow.com/twomillion.md) - Easy Linux machine on HackTheBox — full write-up with a free account. - [Extract](https://thehacksparrow.com/extract.md) - Hard Linux room on TryHackMe — full write-up with Root Access. - [Alien Cradle](https://thehacksparrow.com/alien-cradle.md) - Very Easy forensics challenge on HackTheBox — full write-up with a free account. - [Extraterrestrial Persistence](https://thehacksparrow.com/extraterrestrial-persistence.md) - Very Easy forensics challenge on HackTheBox — full write-up with a free account. - [Contrabando](https://thehacksparrow.com/contrabando.md) - Hard Linux room on TryHackMe — full write-up with Root Access. - [Busqueda](https://thehacksparrow.com/busqueda.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Cerberus](https://thehacksparrow.com/cerberus.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [SOC L2 Alert Triage](https://thehacksparrow.com/soc-l2-alert-triage.md) - Easy room on TryHackMe — full write-up with a free account. - [Inject](https://thehacksparrow.com/inject.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Escape](https://thehacksparrow.com/escape.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Cyborg](https://thehacksparrow.com/cyborg.md) - Easy Linux room on TryHackMe — full write-up with a free account. - [Soccer](https://thehacksparrow.com/soccer.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Mentor](https://thehacksparrow.com/mentor.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Flight](https://thehacksparrow.com/flight.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [Spookifier](https://thehacksparrow.com/spookifier.md) - Very Easy web challenge on HackTheBox — full write-up with a free account. - [Photobomb](https://thehacksparrow.com/photobomb.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [UpDown](https://thehacksparrow.com/updown.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Support](https://thehacksparrow.com/support.md) - Easy Windows machine on HackTheBox — full write-up with a free account. - [RedPanda](https://thehacksparrow.com/redpanda.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [StreamIO](https://thehacksparrow.com/streamio.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Timelapse](https://thehacksparrow.com/timelapse.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [GoodGames](https://thehacksparrow.com/goodgames.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Return](https://thehacksparrow.com/return.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Intelligence](https://thehacksparrow.com/intelligence.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Cap](https://thehacksparrow.com/cap.md) - Easy Linux machine on HackTheBox — full write-up with a free account. - [Knife](https://thehacksparrow.com/knife.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Armageddon](https://thehacksparrow.com/armageddon.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Spectra](https://thehacksparrow.com/spectra.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Delivery](https://thehacksparrow.com/delivery.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Templated](https://thehacksparrow.com/templated.md) - Easy web challenge on HackTheBox — full write-up with a free account. - [Tabby](https://thehacksparrow.com/tabby.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Fuse](https://thehacksparrow.com/fuse.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Blackfield](https://thehacksparrow.com/blackfield.md) - Hard Windows machine on HackTheBox — full write-up with Root Access. - [Magic](https://thehacksparrow.com/magic.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [ServMon](https://thehacksparrow.com/servmon.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Cascade](https://thehacksparrow.com/cascade.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Sauna](https://thehacksparrow.com/sauna.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Monteverde](https://thehacksparrow.com/monteverde.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [OpenAdmin](https://thehacksparrow.com/openadmin.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Resolute](https://thehacksparrow.com/resolute.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Traverxec](https://thehacksparrow.com/traverxec.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Forest](https://thehacksparrow.com/forest.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Networked](https://thehacksparrow.com/networked.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Heist](https://thehacksparrow.com/heist.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Easy Phish](https://thehacksparrow.com/easy-phish.md) - Easy osint challenge on HackTheBox — full write-up with a free account. - [Emdee five for life](https://thehacksparrow.com/emdee-five-for-life.md) - Easy misc challenge on HackTheBox — full write-up with a free account. - [Bastion](https://thehacksparrow.com/bastion.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Netmon](https://thehacksparrow.com/netmon.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Querier](https://thehacksparrow.com/querier.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [FriendZone](https://thehacksparrow.com/friendzone.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Help](https://thehacksparrow.com/help.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Lightweight](https://thehacksparrow.com/lightweight.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Vault](https://thehacksparrow.com/vault.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Access](https://thehacksparrow.com/access.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Active](https://thehacksparrow.com/active.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Jerry](https://thehacksparrow.com/jerry.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Bounty](https://thehacksparrow.com/bounty.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [TartarSauce](https://thehacksparrow.com/tartarsauce.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Valentine](https://thehacksparrow.com/valentine.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Chatterbox](https://thehacksparrow.com/chatterbox.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Nibbles](https://thehacksparrow.com/nibbles.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Bashed](https://thehacksparrow.com/bashed.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Jeeves](https://thehacksparrow.com/jeeves.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Shocker](https://thehacksparrow.com/shocker.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Mirai](https://thehacksparrow.com/mirai.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Blue](https://thehacksparrow.com/blue.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Blocky](https://thehacksparrow.com/blocky.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. - [Find The Easy Pass](https://thehacksparrow.com/find-the-easy-pass.md) - Easy reversing challenge on HackTheBox — full write-up with a free account. - [Granny](https://thehacksparrow.com/granny.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Grandpa](https://thehacksparrow.com/grandpa.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Cronos](https://thehacksparrow.com/cronos.md) - Medium Linux machine on HackTheBox — full write-up with Root Access. - [Arctic](https://thehacksparrow.com/arctic.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Bastard](https://thehacksparrow.com/bastard.md) - Medium Windows machine on HackTheBox — full write-up with Root Access. - [Optimum](https://thehacksparrow.com/optimum.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Devel](https://thehacksparrow.com/devel.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Legacy](https://thehacksparrow.com/legacy.md) - Easy Windows machine on HackTheBox — full write-up with Root Access. - [Lame](https://thehacksparrow.com/lame.md) - Easy Linux machine on HackTheBox — full write-up with Root Access. ## Optional - [RSS Feed](https://thehacksparrow.com/rss/) - [Sitemap](https://thehacksparrow.com/sitemap.xml) - [Full content of pages and posts](https://thehacksparrow.com/llms-full.txt)