Cybersecurity Student | SOC Trainee | Cisco Certified Junior Cybersecurity Analyst | Cisco Cybersecurity Defense Analyst | ISC2 Certified in Cybersecurity
VPN ON
Joined April 2023
- Tweets1.3K
- Following102
- Followers247
- Likes1.6K
Oluwanifemi Felix Oyeniyi retweeted
Day 24 of #31DaysSafer 🔐
Today: Harden Online Payments. 💳
When was the last time you reviewed the payment methods saved to your online accounts?
Stolen card details, fake checkout pages, and compromised accounts can lead to unauthorized purchases.
Take a few minutes to review your online payment security.
→ Remove saved payment methods you no longer use.
→ Enable MFA on your payment accounts.
→ Turn on transaction alerts when available.
→ Review recent activity for unfamiliar charges.
Small changes can help protect your financial information when shopping or paying online.
One small step. One day safer. 🍂
#CybersecurityAwarenessMonth #DigitalHygiene #InfoSec
Oluwanifemi Felix Oyeniyi retweeted
Days 24-25/30:
I went back to the basics of SIEMs, logs. How can you understand what a SIEM outputs if you don't know how to dissect and digest a log file
@Niffeey007 @malik_cybersec @DefendWithFelix @gabbytech01 @KoredeSec @cyberjeremiah
#30DaysCybersecurityChallenge
Days 21-23/30:
I've been working on some side projects and also working on the phishing analysis section on tryhackme
@Niffeey007 @malik_cybersec @DefendWithFelix @KoredeSec @gabbytech01 @cyberjeremiah
#30DaysCybersecurityChallenge
Oluwanifemi Felix Oyeniyi retweeted
Day 83/100
Finished exploiting InsecureBankv2’s content provider: confirmed read, inject, insert, update, AND delete, all unauthenticated.Full CRUD compromise through one exported provider with zero permission checks.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Oluwanifemi Felix Oyeniyi retweeted
Day 81/100
Found and exploited SQL injection in InsecureBankv2’s exported content provider. Dumped the full database schema via adb, no login, no app, just a crafted --where clause.
Confirmed read access → boolean-based test → full UNION injection.
@commando_skiipz @ce3nerd
Day80/100
After getting a username and password yesterday i was able to change the person's username and the password was sent to my SMS in plaintext making any other app that has SMS priv can read it
@commando_skiipz @ce3nerd @KoredeSec @ife0x01 @DefendWithFelix
Oluwanifemi Felix Oyeniyi retweeted
Days 21-23/30:
I've been working on some side projects and also working on the phishing analysis section on tryhackme
@Niffeey007 @malik_cybersec @DefendWithFelix @KoredeSec @gabbytech01 @cyberjeremiah
#30DaysCybersecurityChallenge
Day 20/30:
I always knew about port scans that involve scanning multiple ports of a particular device (vertical scanning), but attackers can also scan one port using multiple ip addresses (horizontal scanning)
@DefendWithFelix @malik_cybersec
#30DaysCybersecurityChallenge
Oluwanifemi Felix Oyeniyi retweeted
Day80/100
After getting a username and password yesterday i was able to change the person's username and the password was sent to my SMS in plaintext making any other app that has SMS priv can read it
@commando_skiipz @ce3nerd @KoredeSec @ife0x01 @DefendWithFelix
Day 79 /100
Found hardcoded test credentials in InsecureBankv2’s source, sitting in a comment that literally says “delete below test accounts once in production.” Never deleted. Username and password shipped in plain sight.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix
Oluwanifemi Felix Oyeniyi retweeted
Day 79 /100
Found hardcoded test credentials in InsecureBankv2’s source, sitting in a comment that literally says “delete below test accounts once in production.” Never deleted. Username and password shipped in plain sight.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix
Day 78/100
critical bug : Authentication bypass via exported activity unauthorized fund transfer with no session , was able to send money from different account to another without check
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Oluwanifemi Felix Oyeniyi retweeted
Day 78/100
critical bug : Authentication bypass via exported activity unauthorized fund transfer with no session , was able to send money from different account to another without check
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Day 77/100
More findings
Backups allowed (allowBackup="true") the hardcoded-key password is pullable with no root
Dev login endpoint accepts any username,no password
Exported activity bypasses login entirely launched the post-login account screen with zero auth
@commando_skiipz
Oluwanifemi Felix Oyeniyi retweeted
GTA 6 officially launches next month.
Here is how to stay alive until November 19:
- Look both ways before crossing the road
- Wear your seatbelt
- Don’t text and drive
- Stay away from random fights
- Don’t climb anything you can fall off
- Don’t eat anything suspicious
- Get enough sleep
- Drink water
- Avoid doing anything that starts with “watch this”
- Absolutely no “one last crazy thing before GTA 6”
We’ve made it this far. Don’t fumble the final month… please.
Oluwanifemi Felix Oyeniyi retweeted
Follow-up: the brands are responding 👇
A fintech confirmed in writing that a lookalike domain I flagged isn't theirs. It had no website at all, just a full email setup built to pass the usual security checks, so emails from it would land looking legit. Reported to the registrar and the mail provider.
Another brand told me their IT team is on it and they've alerted their customers. That scam came back on a new domain, registered minutes before the old one was taken down. They had the replacement ready. Caught it anyway.
Meanwhile, from last night's reports:
the internet banking clone was taken offline ~6 hours after my report
the "rewards" page collecting bank details was blocked by its provider ~9 hours after
I’m also looking for cracked security engineers who want to contribute to making Nigeria’s digital space safer.
If you’re interested in doing some real work, shoot me a DM. : )
Caught several phishing campaigns yesterday and ended up staying up till 5am triaging and analyzing detections.
By the end of it, I’d sent 27 reports to hosting providers, registrars, Google, and the affected brands.
Some of what I found:
- An internet banking clone harvesting account numbers and passwords. I was the first to detect it and scan it publicly.
- Multiple “free data/win rewards” scams tied to the same brand, with one collecting victims’ banking details. One hid its page behind scrambled code, which I decoded and sent to the host after they initially couldn’t identify anything malicious.
-Two fake banking/investment sites, among others.
Most reports have been acknowledged, and two sites have already been suspended.
It was a nerve-wracking night, but seeing the reports turn into action made every minute worth it. : )
Oluwanifemi Felix Oyeniyi retweeted
Day 77/100
More findings
Backups allowed (allowBackup="true") the hardcoded-key password is pullable with no root
Dev login endpoint accepts any username,no password
Exported activity bypasses login entirely launched the post-login account screen with zero auth
@commando_skiipz
Day 76/100
First real mobile findings, on a emulator running InsecureBankv2:
Password printed to logcat in plain text
Username only Base64-encoded, not encrypted
Password saved in SharedPreferences, “encrypted” with a key I’m checking next
@commando_skiipz @ce3nerd
Oluwanifemi Felix Oyeniyi retweeted
Day 20/30:
I always knew about port scans that involve scanning multiple ports of a particular device (vertical scanning), but attackers can also scan one port using multiple ip addresses (horizontal scanning)
@DefendWithFelix @malik_cybersec
#30DaysCybersecurityChallenge
Day 19/30:
As important as SIEMs are, threat intelligence tools are just as important. I learnt about different tools that can be used to analyze a phishing email.
@Niffeey007 @gabbytech01 @KoredeSec @malik_cybersec @DefendWithFelix @cyberjeremiah
#30DaysCybersecurityChallenge
Oluwanifemi Felix Oyeniyi retweeted
Day 73/100
Android platform interaction in MASTG: exported components, intent injection, content provider leaks, deep link abuse, and WebView risks like addJavascriptInterface. Static first: read the manifest. Dynamic: drozer and adb.
@commando_skiipz @KoredeSec
Day 72/100
Android network communication in MASTG: Network Security Configuration, cleartext traffic, user-installed CAs being ignored by default since API 24, and spotting custom TrustManagers that accept every certificate.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix
Oluwanifemi Felix Oyeniyi retweeted
Day 19/30:
As important as SIEMs are, threat intelligence tools are just as important. I learnt about different tools that can be used to analyze a phishing email.
@Niffeey007 @gabbytech01 @KoredeSec @malik_cybersec @DefendWithFelix @cyberjeremiah
#30DaysCybersecurityChallenge
Day 18/30:
Attackers use different types of filenames and paths to blend malware onto a system. Some of those methods include double-extensions and masquerading
@Niffeey007 @malik_cybersec @KoredeSec @gabbytech01 @DefendWithFelix @cyberjeremiah
#30DaysCybersecurityChallenge
Oluwanifemi Felix Oyeniyi retweeted
Day 72/100
Android network communication in MASTG: Network Security Configuration, cleartext traffic, user-installed CAs being ignored by default since API 24, and spotting custom TrustManagers that accept every certificate.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix
Day71/100
Android local authentication in MASTG: BiometricPrompt, why a bare “auth succeeded” callback is bypassable with Frida, and why biometrics should be bound to a Keystore key via CryptoObject.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Oluwanifemi Felix Oyeniyi retweeted
Day 71
Still deep in the MTN VDP.
Update: yesterday’s submission just got updated to “Pending Program Review”, severity now rated High (7.9)
@4osp3l @_DeejustDee @KoredeSec @malik_cybersec @DefendWithFelix
Day 70
Submitted a medium-severity(6.9) finding to a MTN on @Hacker0x01
Hardcoded credentials leading to unauthorized content-editor access across two CMS environments
@4osp3l @KoredeSec @_DeejustDee @malik_cybersec @DefendWithFelix
Oluwanifemi Felix Oyeniyi retweeted
Day71/100
Android local authentication in MASTG: BiometricPrompt, why a bare “auth succeeded” callback is bypassable with Frida, and why biometrics should be bound to a Keystore key via CryptoObject.
@commando_skiipz @ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Day 70/100
Android cryptography in MASTG: Keystore-backed keys (TEE/StrongBox), why keys should never be extractable, and how to test it. Static: grep for Cipher.getInstance and SecretKeySpec. Dynamic: hook javax.crypto with Frida.
@commando_skiipz @ce3nerd @KoredeSec @ife0x01
Oluwanifemi Felix Oyeniyi retweeted
Day 70/100
Android cryptography in MASTG: Keystore-backed keys (TEE/StrongBox), why keys should never be extractable, and how to test it. Static: grep for Cipher.getInstance and SecretKeySpec. Dynamic: hook javax.crypto with Frida.
@commando_skiipz @ce3nerd @KoredeSec @ife0x01
Day 69 /100
Yesterday was a long day Spent my day way from laptop was at the farm all through
@commando_skiipz
@ce3nerd @KoredeSec @DefendWithFelix @ife0x01
Oluwanifemi Felix Oyeniyi retweeted
Just shipped RootPath 🐧
Browser-based Linux terminal built with:
→ Vanilla JS virtual filesystem
→ 60+ real commands
→ 28 lessons from Linux Basics for Hackers by @three_cube
→ Real Debian kernel via WebAssembly
→ Zero dependencies
Try it → rootpath-linux.vercel.app
