ancorn_ | Ngô Thiên An

AI-Driven Code Analysis: The Future of Whitebox Security Testing

Thu, 05 Mar 2026 00:24:25 +0700

ICYMI (In Case You Missed It)

Let’s be real—whitebox pentesting involves a lot of tedious, repetitive steps. From reading and wrapping your head around the context, digging through the logic, hunting for bugs, exploiting them, to the absolute drag of writing reports… it’s a grind. But guess what? AI can now totally carry us through almost all of these phases! In this post, I’m going to flex Antigravity along with its full arsenal of skills and rules to pull off a buttery smooth whitebox pentest.

[POC] CVE-2024-24842 - Unauthenticated PHP Object Injection in plugin Knowledge Base - Wordpress

Mon, 19 Feb 2024 21:24:25 +0700

Knowledge Base for Documentation, FAQs with AI Assistance plugin - Unauthenticated PHP Object Injection

✋ Table of content

About Knowledge Base for Documentation, FAQs with AI Assistance plugin
The security vulnerability
The patch
Conclusion

This blog post is about the Knowledge Base for Documentation, FAQs with AI Assistance plugin vulnerability. If you’re using this plugin, please update the plugin to at least version 11.31.0.

About Knowledge Base for Documentation, FAQs with AI Assistance plugin

The plugin Knowledge Base for Documentation, FAQs with AI Assistance (versions 11.30.2 and below), which is estimated to have over 10,000 active installations.

[POC] CVE-2020-7769 - Command Injection in nodemailer

Sun, 03 Sep 2023 21:24:25 +0700

Introduction

Command Injection in nodemailer

Someday, i read some product code and found out that application using nodemailer to send email. After spending some second to audit package-lock file, i saw it had this CVE.

But i read that details and their POC, i still not understand what they want to deliver.

Found their commit to fix their bug and already know where the bug from https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54

It comes from send function, with arbitrary command flag injection in sendmail transport.

About ancorn_

Mon, 01 Jan 0001 00:00:00 +0000

Hey, I’m Ngô Thiên An or you can call me ancorn_ 👋

OSWE-certified Penetration Testing Expert, Security Researcher, and Bug Bounty Hunter chilling in Da Nang, Vietnam.

“In breaking things, we learn how they work.” — my mindset in the wild world of cyber

What I Do

Penetration Tester @ VNPT-VCI
Security Researcher @ Synack Red Team
Software Engineer @ Chative

Certs & Badges

OffSec Web Expert (OSWE)
Google Project Management

Wins & Brags

My CVEs:

News & Posts

My hobbies:

📈 Exploring Economics, Financial Markets, and Real Estate.
🈯 Learning basic Chinese.
🍈 Enjoying Durian (the ultimate fruit!).
🤖 Tinkering with AI agents and LLMs.

I learn by finding problems and breaking them — that’s why I love cybersecurity. This blog? My playground for pentest tips, bug bounty stories, and random cyber rants.