Anmao Gou

Anmao Gou

I am a security researcher currently seeking an internship. I usually use the ID “Fushuling” or “狗and猫” online. I have discovered security vulnerabilities in over 50 open-source projects with 10k+ stars—including Apache, MySQL, vLLM, Spring, LangChain, OpenClaw, AutoGPT, hermes-agent, and Jenkins—all of which were subsequently acknowledged and patched. I have also received formal acknowledgments from major tech companies such as Microsoft, Amazon, and Oracle. In addition, I have reported multiple vulnerabilities to the CNVD that received the highest severity rating, and my findings have twice been featured in Tencent Cloud Security’s “Must-Fix Vulnerabilities of the Month” list. The full record is available in my vulnerability list.

I am passionate about sharing my thoughts and insights. Since my freshman year of college, I have maintained a blog at fushuling.com, which has now garnered nearly one million visits. I have authored numerous engaging and influential posts, uncovered unique exploitation techniques, and remain an active participant in various professional knowledge-sharing communities. XD

📝 Publications

  1. IEEE S&P’27 Babel of Voices: Demystifying Security Threats Arising from Cross-Specification URL Parsing Inconsistencies in Web Applications
    Qiyi Zhang, Anmao Gou, Youkun Shi, Fengyu Liu, Yuan Zhang.
    In Proceedings of the 48th IEEE Symposium on Security and Privacy (S&P), May 2027.

💬 Conferences

🛠️ Projects

  • TaintScaner, 170+ stars: a PHP static analysis tool.
  • jdbc-tricks, 580+ stars: a collection of many JDBC security research results.

🏅 Rewards

I was an active CTF player on team SU , competing with my teammates in many well-known domestic and international contests. I have also authored challenges for several major competitions, including XCTF, DASCTF, and internal contests of state-owned enterprises. With the rise of AI, I am no longer active in CTF.

  • 2025, XCTF-L3HCTF, Champion 🏆, with「SU」
  • 2024, XCTF-RCTF, Runner-up 🥈, with「SU」
  • 2023, Longjian Cup, Student Group Champion 🏆 in the semifinal and 8th place overall (Third Prize) in the final, with「root」
  • 2023, XCTF-ACTF, Runner-up 🥈, with「SU」
  • 2023, RealWorldCTF (Experience Round), Runner-up 🥈, with「SU」

👑 Honors

  • 2025, Second Prize, Open Source Vulnerability Discovery Track, Open Source Security Reward Program
  • 2025, 6th Place, PHP Track, Alibaba Fumo Challenge
  • 2025, Outstanding Partner, XCTF Satellite Contest
  • 2025, Open Source Pioneer Award, Fudan University
  • 2024, Annual Honor Master, Chunqiu Cloud
  • 2023, Annual Honor Master, Chunqiu Cloud

📖 Educations

  • 2025.09 - present, Master’s student, Fudan University (SecSys Lab)
  • 2021.09 - 2025.06, Bachelor in Cyberspace Security, Chongqing University of Posts and Telecommunications

💻 Internships

  • 2023.07 - 2023.12, Intelligence and Offensive/Defensive Operations Laboratory, Xiaohongshu, China

🧑‍🏫 Services

  • 2025 & 2026, Sub-Reviewer, USENIX Security Symposium.
  • 2025 - 2026, Teaching Assistant, System Security Attack and Defense Technology, Fudan University: responsible for lab teaching and CTF challenge design, authored 50+ challenges, and was awarded Outstanding Teaching Assistant.