Now the "Day" directory will sort in the correct order.

README.md

@@ -12,100 +12,100 @@ S.NO | Mind Map
 ___
 Day | Topic
 --- | ---
-**1** |  [2FA Bypass Techniques](/days/day1.md)
-**2** | [Regular Expression Denial Of Service](/days/day2.md)
-**3** | [SAML Vulnerabilities](/days/day3.md)
-**4** | [Unauthenticated & Exploitable JIRA Vulnerabilities ](/days/day4.md)
-**5** | [Client-Side Template Injection(CSTI)](/days/day5.md)
-**6** | [Cross-Site Leaks (XS-Leaks)](/days/day6.md)
-**7** | [Cross-Site Script Includes (XSSI)](/days/day7.md)
-**8** | [JSON Padding Attacks](/days/day8.md)
-**9** | [JSON Attacks](/days/day9.md)
-**10** | [Abusing Hop-by-Hop Headers](/days/day10.md)
-**11** | [Cache Poisoned Denial of Service (CPDos)](/days/day11.md)
-**12** | [Unicode Normalization](/days/day12.md)
-**13** | [WebSocket Vulns (Part-1)](/days/day13.md)
-**14** | [WebSocket Vulns (Part-2)](/days/day14.md)
-**15** | [WebSocket Vulns (Part-3)](/days/day15.md)
-**16** | [Web Cache Deception Attack](/days/day16.md)
-**17** | [Session Puzzling Attack](/days/day17.md)
-**18** | [Mass Assignment Attack](/days/day18.md)
-**19** | [HTTP Parameter Pollution](/days/day19.md)
-**20** | [GraphQL Series (Part-1)](/days/day20.md)
-**21** | [GraphQL Vulnerabilities (Part-2)](/days/day21.md)
-**22** | [GraphQL WrapUp (Part-3)](/days/day22.md)
-**23** | [Password Reset Token Issues](/days/day23.md)
-**24** | [My previous works](/days/day24.md)
-**25** | [Salesforce Security Misconfiguration (Part-1)](/days/day25.md)
-**26** | [Salesforce Security Misconfiguration (Part-2))](/days/day26.md)
-**27** | [Salesforce Configuration Review (Wrap)](/days/day27.md)
-**28** | [Common Business Logic Issues: Part-1](/days/day28.md)
-**29** | [Common Business Logic Issues (Part-2)](/days/day29.md)
-**30** | [Common Business Logic Issues (Wrap)](/days/day30.md)
-**31** | [Captcha Bypass Techniques](/days/day31.md)
-**32** | [Pentesting Kibana Service](/days/day32.md)
-**33** | [Pentesting Docker Registry](/days/day33.md)
-**34** | [HTML Scriptless Attacks / Dangling Markup Attacks (Part - 1)](/days/day34.md)
-**35** | [HTML Scriptless Attacks / Dangling Markup Attacks (Wrap)](/days/day35.md)
-**36** | [Pentesting Rsync Service](/days/day36.md)
-**37** | [CRLF Injection](/days/day37.md)
-**38** | [Pentesting FTP Service](/days/day38.md)
-**39** | [OpenID Connect Implementation Issues](/days/day39.md)
-**40** | [Cookie Based Authentication Vulnerabilities](/days/day40.md)
-**41** | [Cobalt Vulnerability Wiki - Resource](/days/day41.md)
-**42** | [Race Conditions](/days/day42.md)
-**43** | [SMTP Open Relay Attack](/days/day43.md)
-**44** | [Pentesting BACNet](/days/day44.md)
-**45** | [API Security Tips](/days/day45.md)
-**46** | [Pentesting SSH - Talk](/days/day46.md)
-**47** | [CORS Misconfiguration](/days/day47.md)
-**48** | [Incomplete Trailing Escape Pattern Issue](/days/day48.md)
-**49** | [Pivoting & Exploitation in Docker Environments - Talk](/days/day49.md)
-**50** | [Detect Complex Code Patterns using Semantic grep - Talk](/days/day50.md)
-**51** | [Student Roadmap to Become a Pentester - Talk](/days/day51.md)
-**52** | [Hacking How-To Series - Playlist](/days/day52.md)
-**53** | [JS Prototype Pollution](/days/day53.md)
-**54** | [JSON Deserialization Attacks](/days/day54.md)
-**55** | [Android App Dynamic Analysis using House](/days/day55.md)
-**56** | [Testing IIS Servers](/days/day56.md)
-**57** | [Secure Code Review - Talk](/days/day57.md)
-**58** | [JSON Interoperability Vulnerabilities - Research Blog](/days/day58.md)
-**59** | [HTTP Desync Attacks - Talk](/days/day59.md)
-**60** | [XSLT Injection](/days/day60.md)
-**61** | [Bypassing AWS Policies - Talk](/days/day61.md)
-**62** | [Source Code Review Guidelines - Resource](/days/day62.md)
-**63** | [All of the Threats: Intelligence, Modelling and Hunting - Talk](/days/day63.md)
-**64** | [Hidden Property Abuse (HPA) attack in Node.js - Talk](/days/day64.md)
-**65** | [HTTP Request Smuggling in 2020 - Talk](/days/day65.md)
-**66** | [Dependecy Confusion Attack - Blog](/days/day66.md)
-**67** | [Format String Vulnerabilities - Webinar](/days/day67.md)
-**68** | [Mobile Application Dynamic Analysis - Webinar](/days/day68.md)
-**69** | [Insecure Deserialization - Talk](/days/day69.md)
-**70** | [Web Cache Entanglement - Talk + Blog](/days/day70.md)
-**71** | [OWASP AMASS - Bootcamp](/days/day71.md)
-**72** | [Offensive Javascript Techniques for Red Teamers](/days/day72.md)
-**73** | [Basic CMD for Pentesters - Cheatsheet](/days/day73.md)
-**74** | [Investigating and Defending Office 365 - Talk](/days/day74.md)
-**75** | [WinjaCTF 2021 Solutions - Blog](/days/day75.md)
-**76** | [Kubernetes Security: Attacking and Defending K8s Clusters - Talk](/days/day76.md)
-**77** | [AWS Cloud Security - Resources](/days/day77.md)
-**78** | [WAF Evasion Techniques - Blog](/days/day78.md)
-**79** | [File Inclusion - All-in-One](/days/day79.md)
-**80** | [DockerENT Insights - Tool Demo Talk](/days/day80.md)
-**81** | [ImageMagick - Shell injection via PDF password : Research Blog](/days/day81.md)
-**82** | [Offensive GraphQL API Pentesting - Talk](/days/day82.md)
-**83** | [Bug Bounties with Bash - Talk](/days/day83.md)
-**84** | [Chrome Extensions Code Review - Talk](/days/day84.md)
-**85** | [Server-Side Template Injection - Talk](/days/day85.md)
-**86** | [Exploiting GraphQL - Blog](/days/day86.md)
-**87** | [Exploiting Email Systems - Talk](/days/day87.md)
-**88** | [Hacking with DevTools - Tutorial](/days/day88.md)
-**89** | [Common Android Application Vulnerabilities - Talk](/days/day89.md)
-**90** | [SAML XML Injection - Research Blog](/days/day90.md)
-**91** | [Finding Access Control & Authorization Issues with Burp - Blogs](/days/day91.md)
-**92** | [OAuth 2.0 Misimplementation, Vulnerabilities, and Best Practices - Talk](/days/day92.md)
-**93** | [JWT Attacks - Talk](/days/day93.md)
-**94-102** | [Random Readings](/days/day94_102.md)
+**1** |  [2FA Bypass Techniques](/days/day001.md)
+**2** | [Regular Expression Denial Of Service](/days/day002.md)
+**3** | [SAML Vulnerabilities](/days/day003.md)
+**4** | [Unauthenticated & Exploitable JIRA Vulnerabilities ](/days/day004.md)
+**5** | [Client-Side Template Injection(CSTI)](/days/day005.md)
+**6** | [Cross-Site Leaks (XS-Leaks)](/days/day006.md)
+**7** | [Cross-Site Script Includes (XSSI)](/days/day007.md)
+**8** | [JSON Padding Attacks](/days/day008.md)
+**9** | [JSON Attacks](/days/day009.md)
+**10** | [Abusing Hop-by-Hop Headers](/days/day010.md)
+**11** | [Cache Poisoned Denial of Service (CPDos)](/days/day011.md)
+**12** | [Unicode Normalization](/days/day012.md)
+**13** | [WebSocket Vulns (Part-1)](/days/day013.md)
+**14** | [WebSocket Vulns (Part-2)](/days/day014.md)
+**15** | [WebSocket Vulns (Part-3)](/days/day015.md)
+**16** | [Web Cache Deception Attack](/days/day016.md)
+**17** | [Session Puzzling Attack](/days/day017.md)
+**18** | [Mass Assignment Attack](/days/day018.md)
+**19** | [HTTP Parameter Pollution](/days/day019.md)
+**20** | [GraphQL Series (Part-1)](/days/day020.md)
+**21** | [GraphQL Vulnerabilities (Part-2)](/days/day021.md)
+**22** | [GraphQL WrapUp (Part-3)](/days/day022.md)
+**23** | [Password Reset Token Issues](/days/day023.md)
+**24** | [My previous works](/days/day024.md)
+**25** | [Salesforce Security Misconfiguration (Part-1)](/days/day025.md)
+**26** | [Salesforce Security Misconfiguration (Part-2))](/days/day026.md)
+**27** | [Salesforce Configuration Review (Wrap)](/days/day027.md)
+**28** | [Common Business Logic Issues: Part-1](/days/day028.md)
+**29** | [Common Business Logic Issues (Part-2)](/days/day029.md)
+**30** | [Common Business Logic Issues (Wrap)](/days/day030.md)
+**31** | [Captcha Bypass Techniques](/days/day031.md)
+**32** | [Pentesting Kibana Service](/days/day032.md)
+**33** | [Pentesting Docker Registry](/days/day033.md)
+**34** | [HTML Scriptless Attacks / Dangling Markup Attacks (Part - 1)](/days/day034.md)
+**35** | [HTML Scriptless Attacks / Dangling Markup Attacks (Wrap)](/days/day035.md)
+**36** | [Pentesting Rsync Service](/days/day036.md)
+**37** | [CRLF Injection](/days/day037.md)
+**38** | [Pentesting FTP Service](/days/day038.md)
+**39** | [OpenID Connect Implementation Issues](/days/day039.md)
+**40** | [Cookie Based Authentication Vulnerabilities](/days/day040.md)
+**41** | [Cobalt Vulnerability Wiki - Resource](/days/day041.md)
+**42** | [Race Conditions](/days/day042.md)
+**43** | [SMTP Open Relay Attack](/days/day043.md)
+**44** | [Pentesting BACNet](/days/day044.md)
+**45** | [API Security Tips](/days/day045.md)
+**46** | [Pentesting SSH - Talk](/days/day046.md)
+**47** | [CORS Misconfiguration](/days/day047.md)
+**48** | [Incomplete Trailing Escape Pattern Issue](/days/day048.md)
+**49** | [Pivoting & Exploitation in Docker Environments - Talk](/days/day049.md)
+**50** | [Detect Complex Code Patterns using Semantic grep - Talk](/days/day050.md)
+**51** | [Student Roadmap to Become a Pentester - Talk](/days/day051.md)
+**52** | [Hacking How-To Series - Playlist](/days/day052.md)
+**53** | [JS Prototype Pollution](/days/day053.md)
+**54** | [JSON Deserialization Attacks](/days/day054.md)
+**55** | [Android App Dynamic Analysis using House](/days/day055.md)
+**56** | [Testing IIS Servers](/days/day056.md)
+**57** | [Secure Code Review - Talk](/days/day057.md)
+**58** | [JSON Interoperability Vulnerabilities - Research Blog](/days/day058.md)
+**59** | [HTTP Desync Attacks - Talk](/days/day059.md)
+**60** | [XSLT Injection](/days/day060.md)
+**61** | [Bypassing AWS Policies - Talk](/days/day061.md)
+**62** | [Source Code Review Guidelines - Resource](/days/day062.md)
+**63** | [All of the Threats: Intelligence, Modelling and Hunting - Talk](/days/day063.md)
+**64** | [Hidden Property Abuse (HPA) attack in Node.js - Talk](/days/day064.md)
+**65** | [HTTP Request Smuggling in 2020 - Talk](/days/day065.md)
+**66** | [Dependecy Confusion Attack - Blog](/days/day066.md)
+**67** | [Format String Vulnerabilities - Webinar](/days/day067.md)
+**68** | [Mobile Application Dynamic Analysis - Webinar](/days/day068.md)
+**69** | [Insecure Deserialization - Talk](/days/day069.md)
+**70** | [Web Cache Entanglement - Talk + Blog](/days/day070.md)
+**71** | [OWASP AMASS - Bootcamp](/days/day071.md)
+**72** | [Offensive Javascript Techniques for Red Teamers](/days/day072.md)
+**73** | [Basic CMD for Pentesters - Cheatsheet](/days/day073.md)
+**74** | [Investigating and Defending Office 365 - Talk](/days/day074.md)
+**75** | [WinjaCTF 2021 Solutions - Blog](/days/day075.md)
+**76** | [Kubernetes Security: Attacking and Defending K8s Clusters - Talk](/days/day076.md)
+**77** | [AWS Cloud Security - Resources](/days/day077.md)
+**78** | [WAF Evasion Techniques - Blog](/days/day078.md)
+**79** | [File Inclusion - All-in-One](/days/day079.md)
+**80** | [DockerENT Insights - Tool Demo Talk](/days/day080.md)
+**81** | [ImageMagick - Shell injection via PDF password : Research Blog](/days/day081.md)
+**82** | [Offensive GraphQL API Pentesting - Talk](/days/day082.md)
+**83** | [Bug Bounties with Bash - Talk](/days/day083.md)
+**84** | [Chrome Extensions Code Review - Talk](/days/day084.md)
+**85** | [Server-Side Template Injection - Talk](/days/day085.md)
+**86** | [Exploiting GraphQL - Blog](/days/day086.md)
+**87** | [Exploiting Email Systems - Talk](/days/day087.md)
+**88** | [Hacking with DevTools - Tutorial](/days/day088.md)
+**89** | [Common Android Application Vulnerabilities - Talk](/days/day089.md)
+**90** | [SAML XML Injection - Research Blog](/days/day090.md)
+**91** | [Finding Access Control & Authorization Issues with Burp - Blogs](/days/day091.md)
+**92** | [OAuth 2.0 Misimplementation, Vulnerabilities, and Best Practices - Talk](/days/day092.md)
+**93** | [JWT Attacks - Talk](/days/day093.md)
+**94-102** | [Random Readings](/days/day094_102.md)
 **103** | [Attacking Ruby on Rails Applications - Whitepaper](/days/day103.md)
 **104** | [Pentesting a Chrome Extension: Real Life Case Study - Blog](/days/day104.md)
 **105** | [XXE Simplified - Blog](/days/day105.md)

days/day10.md → days/day010.md

@@ -73,4 +73,4 @@ https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/Bur
 https://0xn3va.gitbook.io/cheat-sheets/web-application/abusing-http-hop-by-hop-request-headers
 
 https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers
-```
+```

days/day11.md → days/day011.md

@@ -90,4 +90,4 @@ X-HTTP-Method-Override: DELETE
 3. https://hackerone.com/reports/921704
 4. https://hackerone.com/reports/326639
 5. https://hackerone.com/reports/591302
-```
+```

days/day12.md → days/day012.md

@@ -29,4 +29,4 @@ ___
 1. WAF & Filter Bypass for Attacks like XSS, SQLi, etc.
 2. Account Takeovers 
 3. Text Transformation Attacks
-```
+```

days/day13.md → days/day013.md

@@ -47,4 +47,4 @@ ___
 #### References
 ```
 WebSocket Top 7 Vuln: https://www.neuralegion.com/blog/websocket-security-top-vulnerabilities/
-```
+```

days/day14.md → days/day014.md

@@ -23,4 +23,4 @@ Look for all IDORs cases that you look for in normal HTTP workflow
 2. This behavior can be abused by an attacker to exhaust resources and perform a Denial of Service Attack.
 
 - Try sending multiple requests to initiate a WS connection in a short time, this may trigger some lagging in the app processing which can be lead to App Level DoS.
-```
+```

days/day15.md → days/day015.md

@@ -51,4 +51,4 @@ PortSwigger: https://portswigger.net/web-security/websockets
 - https://hackerone.com/reports/512065
 - https://hackerone.com/reports/1023669
 - https://hackerone.com/reports/86283
-```
+```

days/day34.md → days/day034.md

@@ -56,4 +56,4 @@ steal me'<b>test</b>
 ```
 a. http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/
 
-```
+```

days/day35.md → days/day035.md

@@ -57,4 +57,4 @@ ___
 a. https://book.hacktricks.xyz/pentesting-web/dangling-markup-html-scriptless-injection
 b. https://github.com/cure53/HTTPLeaks/blob/main/leak.html
 c. https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup
-```
+```

days/day36.md → days/day036.md

@@ -61,4 +61,4 @@ a. https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#rsync-port-
 b. https://blog.netspi.com/linux-hacking-case-studies-part-1-rsync/
 c. https://medium.com/@minimalist.ascent/enumerating-rsync-servers-with-examples-cc3718e8e2c0
 
-```
+```

days/day37.md → days/day037.md

@@ -76,4 +76,4 @@ b. https://medium.com/cyberverse/crlf-injection-playbook-472c67f1cb46
 c. https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CRLF%20Injection
 d. https://medium.com/bugbountywriteup/bugbounty-exploiting-crlf-injection-can-lands-into-a-nice-bounty-159525a9cb62
 
-```
+```

days/day38.md → days/day038.md

@@ -64,4 +64,4 @@ c. https://www.hackingarticles.in/ftp-penetration-testing-on-ubuntu-port-21/
 d. https://www.mindpointgroup.com/blog/cyber-security/conducting-and-detecting-data-exfiltration/
 e. https://www.briskinfosec.com/blogs/blogsdetail/FTP-Penetration-Testing
 
-```
+```

days/day39.md → days/day039.md

@@ -47,4 +47,4 @@ ___
 a. This is a really nice article and fun read to understand about the implementation and issues. Kudos to the researcher.
 b. Original Tweet: https://twitter.com/_lauritz_/status/1322242562216890369
 
-```
+```

days/day40.md → days/day040.md

@@ -161,4 +161,4 @@ f. https://github.com/harsh-bothra/learn365/blob/main/days/day17.md
 g. https://medium.com/@tehmezovismayil/cookie-based-php-local-file-inclusion-bug-bounty-553f8b38d4dc
 h. https://secureteam.co.uk/articles/web-application-security-articles/understanding-session-fixation-attacks/
 
-```
+```

days/day42.md → days/day042.md

@@ -48,4 +48,4 @@ a. https://medium.com/@pravinponnusamy/race-condition-vulnerability-found-in-bug
 b. https://hackerone.com/reports/759247
 c. https://book.hacktricks.xyz/pentesting-web/race-condition#oauth2-eternal-persistence
 
-```
+```

days/day43.md → days/day043.md

@@ -56,4 +56,4 @@ h. .
 a. https://www.blackhillsinfosec.com/how-to-test-for-open-mail-relays/
 b. https://www.rapid7.com/db/modules/auxiliary/scanner/smtp/smtp_relay/
 
-```
+```

days/day44.md → days/day044.md

@@ -84,4 +84,4 @@ b. https://sapsan.on.fleek.co/hacktricks/pentesting/47808-udp-bacnet/
 c. https://hitcon.org/2015/ENT/PDF/Building%20Automation%20and%20Control_miaoski.pdf
 d. https://www.blackhat.com/docs/us-17/wednesday/us-17-Brandstetter-insecurity-In-Building-Automation-How-To-Create-Dark-Buildings-With-Light-Speed.pdf
 
-```
+```

days/day45.md → days/day045.md

@@ -13,4 +13,4 @@ ___
 
 a. https://t.co/Sjh5fbU8zA?amp=1
 
-```
+```

days/day46.md → days/day046.md

@@ -16,4 +16,4 @@ a. https://t.co/yvyyxEOBdl?amp=1
 
 ```
 
-#### Complete Content To Be Updated.
+#### Complete Content To Be Updated.

days/day47.md → days/day047.md

@@ -104,4 +104,4 @@ c. https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoi
 d. https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397
 e. https://www.corben.io/advanced-cors-techniques/https://github.com/chenjj/CORScanner
 
-```
+```

days/day48.md → days/day048.md

@@ -36,4 +36,4 @@ This is one of the recently encountered scenario, there may be other impact of t
 ```
 a. https://www.programmersought.com/article/1312520870/
 
-```
+```

days/day49.md → days/day049.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://www.youtube.com/watch?v=id7phzfgumg&list=PLruly0ngXhPF6SAjbleQ-Icm8kSu1lTNr&index=32
+#### Learning Resource: https://www.youtube.com/watch?v=id7phzfgumg&list=PLruly0ngXhPF6SAjbleQ-Icm8kSu1lTNr&index=32

days/day50.md → days/day050.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://www.youtube.com/watch?v=IFRp2Y3cqOw&list=PLruly0ngXhPGvyl-gOp4d_TvIiedloX1l&index=16
+#### Learning Resource: https://www.youtube.com/watch?v=IFRp2Y3cqOw&list=PLruly0ngXhPGvyl-gOp4d_TvIiedloX1l&index=16

days/day51.md → days/day051.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://t.co/LAhhUhH1VR?amp=1
+#### Learning Resource: https://t.co/LAhhUhH1VR?amp=1

days/day52.md → days/day052.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://youtube.com/playlist?list=PL1kKTj_P1E0wcSpop-TtDHUSNJZDofFzX
+#### Learning Resource: https://youtube.com/playlist?list=PL1kKTj_P1E0wcSpop-TtDHUSNJZDofFzX

days/day53.md → days/day053.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://t.co/FLt7ZwD3I3?amp=1
+#### Learning Resource: https://t.co/FLt7ZwD3I3?amp=1

days/day55.md → days/day055.md

@@ -7,4 +7,4 @@ Index | Section
 ___
 
 
-#### Learning Resource: https://www.youtube.com/watch?v=n7vW-TVtXb0
+#### Learning Resource: https://www.youtube.com/watch?v=n7vW-TVtXb0

days/day56.md → days/day056.md

@@ -9,4 +9,4 @@ ___
 
 #### Learning Resource:
 * https://t.co/6AREbPdhZy?amp=1
-* https://t.co/5eZJUWZ3bf?amp=1
+* https://t.co/5eZJUWZ3bf?amp=1

days/day57.md → days/day057.md

@@ -8,4 +8,4 @@ ___
 
 
 #### Learning Resource:
-* https://www.youtube.com/watch?v=0hczZ9wrYAU
+* https://www.youtube.com/watch?v=0hczZ9wrYAU

days/day58.md → days/day058.md

@@ -43,4 +43,4 @@ a. https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-
 
 ```
 
-#### Note: This work is carried out by BishopFox Labs & this repository doesn't take any credit for the same. Shoutout to @theBumbleSec for sharing this research work.
+#### Note: This work is carried out by BishopFox Labs & this repository doesn't take any credit for the same. Shoutout to @theBumbleSec for sharing this research work.