(Research) Exploiting HTTP Parsers Inconsistencies

https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies

Some, think they are too mighty to fall.
However this is often a facade, now laid bare before you.
Now, let me be the flame that burns Icarus and show that even the gods can bleed.

I present to you, a dump of Palestine's entire healthcare system.

Contents:
1,166,252x NCD Nursing Records (Split into 1,2 or 6 month chunks)
65,589x Nurse Visit Reports
30,990x NCD Reports
29,370x NCD Screenings
7,852x Child Hemoglobin Tests
2,879x Emergency Nursing Records
1,391x Mental Health Screenings
1x Statistics Report

Total count - 1,304,324 Records (For context, the total population of Palestine is ~4.9 Million people)


~ With love, The Archivist

Here is a very poorly written way to do 'whoami' using CreateNamedPipe and Advapi32!NpGetUserName.

This undocumented function will do the generic LookupAccountSidW via GetUserNameExW, but it can act as a proxy function, or something.

https://pastebin.com/raw/ZsReS7k4

If anyone has a Flipper Zero, what you use the radio module for?

Blackhat operators: what do you usually do for choosing a target?

me af