NERDY Blog

a simple whitehat blog for hackers

a distill-style blog post

an example of a distill-style blog post and main elements

25 min read · 2021

a post with code

an example of a blog post with some code

4 min read · 2015

Statica — Bypassing AI Assistant Secret Masking

How asking an AI assistant to return a secret in a different format completely bypassed a regex-based masking filter.

4 min read · July 14, 2026

2026 · ctf web ai encoding webverse · writeups
Ashwick

How a local file inclusion vulnerability combined with Apache access log poisoning achieved remote code execution on the Township of Ashwick challenge.

5 min read · July 13, 2026

2026 · ctf web lfi rce log-poisoning php webverse · writeups
Snobble AI

Snobble AI

7 min read · July 07, 2026

2026 · ctf web AI Prompt · writeups
Ohmly — Reading Secret Files Through the Datasheet Download

How an unsanitized filename parameter in a PDF download endpoint enabled path traversal to read arbitrary server files including the flag.

3 min read · July 07, 2026

2026 · ctf web path-traversal lfi php · writeups
Hookery — Faking a Login by Reusing a Public Key

How a shared key between webhook verification and login sessions enabled a JWT algorithm confusion attack to forge admin access.

4 min read · July 07, 2026

2026 · ctf web jwt authentication algorithm-confusion · writeups