Winston Ighodaro
@Officialwhyte22
Followers
8K
Following
2K
Media
540
Statuses
3K
Ethical Hacker, Forensic Investigator, Malware Engineer. Security+, Network+, Pentest+, and CNVP. Python, bash, Powershell, Java script, Html and C#. I am root.
Root
Joined June 2022
My story, My mission. Hello cyber enthusiasts, Get ready for an exciting story, ayyy!! My name is Winston Ighodaro. I'm a Pentester/Ethical Hacker, Blogger, Christian and a Nigerian. This story is going to be fun, so grab your coffee and keep reading! I got my first break in
32
51
236
I scanned a server and found Jenkins running on port 8080 with the Jetty engine. After a successful login using weak credentials, I accessed the script console and ran arbitrary code. This misconfiguration gave me full control over the CI/CD pipeline.
2
11
91
I scanned a server and found Jenkins running on port 8080 with the Jetty engine. After a successful login using weak credentials, I accessed the script console and ran arbitrary code. This misconfiguration gave me full control over the CI/CD pipeline.
2
11
91
I found an open-source project with insecure GitHub Actions workflows triggered by pull requests. I forked the repo, committed a malicious workflow that downloads a reverse shell payload from my server.
0
6
32
I found an open-source project with insecure GitHub Actions workflows triggered by pull requests. I forked the repo, committed a malicious workflow that downloads a reverse shell payload from my server.
0
6
32
I compromised a container that had the Docker socket mounted (/var/run/docker.sock) and used it to mount the host file system. After escaping, I stole EC2 instance credentials from /root/.aws/credentials, dumped metadata, and exfiltrated a ZIP of secrets using nc. This attack
4
22
146
I compromised a container that had the Docker socket mounted (/var/run/docker.sock) and used it to mount the host file system. After escaping, I stole EC2 instance credentials from /root/.aws/credentials, dumped metadata, and exfiltrated a ZIP of secrets using nc. This attack
4
22
146
I analyzed a malicious Chrome extension that impersonated a productivity tool but silently extracted browser cookies and localStorage tokens. It targeted a finance dashboard, stealing session data and uploading it via Fetch to a remote server. The code masked activity under a
3
60
424
Skip the expensive IVs! Oral NAD+ precursors like NMN and NR are scientifically proven to work better and last longer. Access the benefits at home with bioavailable ingredients you can trust.
5
6
39
Today’s session focused on reviewing a capture where 203.0.113.4 communicated heavily with 198.51.100.23, raising flags around repeated lookups to https://t.co/gBuuxa6r2h. The analyzer highlighted a suspicious TLS handshake pointing to https://t.co/iy6AEFshxY, suggesting possible
1
5
24
Today’s session focused on reviewing a capture where 203.0.113.4 communicated heavily with 198.51.100.23, raising flags around repeated lookups to https://t.co/gBuuxa6r2h. The analyzer highlighted a suspicious TLS handshake pointing to https://t.co/iy6AEFshxY, suggesting possible
1
5
24
I scanned a Jenkins endpoint hosted at 135.181.217.213, discovered a script console exposed on port 8080, and injected code to dump environment variables. From the logs, I exfiltrated Git credentials and triggered a private pipeline to dump artifacts from a staging server
5
51
375
2
1
7
I compromised a misconfigured Jenkins instance and injected a malicious .sh script into the build pipeline. The shell script triggered on every push and uploaded .env secrets to an attacker-controlled server. Netstat confirmed active C2 comms to a Romanian VPS over port 8080.
0
5
53
With 15k your troubles will be gone!!
5
1
9
BIG WEEK FOR HELIUM! won Best Wi-Fi Innovation at the @WBAlliance awards 2025 in Paris, France! 🏆
11
19
103
A fake invoice lured the victim into executing a VBScript that launched a Python payload via wscript.exe. The payload captured webcam and screen frames, stored them locally in C:\ProgramData, and uploaded the data via HTTP POST to an attacker-controlled server hosted in Germany.
2
34
194
I investigated a compromised CI/CD pipeline where a rogue GitHub Actions workflow pulled and deployed a malicious Go binary from an attacker’s server. The compiled malware mimicked a legitimate service and tunneled data via HTTP POST requests to a C2 domain.
1
22
137
Upland is the city-builder where what you create actually matters. - Own real-world properties. - Build neighborhoods that attract digital residents called Uppies. - Trade, earn, and grow a city that never resets.
5
32
86
The system was infected by fileless malware leveraging wmic and reflective DLL injection. Malicious PowerShell ran entirely in memory, leaving no disk artifacts. Analysis of memory dumps revealed a hidden backdoor. Volatility confirmed injected threads and encoded PowerShell code
5
59
331