# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 1 Introduction  
With the advent of the era of the Internet of Things (IoT), countless new devices are being connected to the network to meet different application requirements. IoT devices are now omnipresent in our lives. According to the \"Mobile Economy 2020\" report released by the GSMA [1], it is predicted that by around 2025, the total number of global IoT device connections will reach 24.6 billion. Though the scale of the Internet of Things (IoT) industry is continuously expanding, the development of related security standards has yet to keep pace. Furthermore, developers have yet to be completely aware of device security maintenance. As a result, current IoT devices carry many severe security risks. The functionality of Internet of Things (IoT) devices is predominantly governed by firmware, which is the underlying software responsible for controlling hardware operations to ensure that the devices perform as intended. As the number of devices connected to the Internet of Things (IoT) increases, firmware-targeted attacks have become moreprevalent. If attackers gain access, they may remotely control devices, exfiltrate sensitive data, and use them as springboards for further network intrusions. Firmware typically restricts access to unauthorized external users, granting only authorized users or system administrators limited permissions for specific access and modification. To ensure the user-friendly operation of devices, it is a common practice to provide specific terminal applications or web interfaces. Therefore, web interfaces usually suffer a large number of attacks as exposed points of IoT devices in the network. This paper focuses on discovering vulnerabilities in firmware web servers. In recent years, considerable work has been carried out on discovering firmware vulnerabilities, including dynamic [2; 3; 4; 5; 6; 7; 8] and static [9; 10; 11; 12; 13; 14] analyses. Within dynamic analyses, employing emulation techniques for grey-box fuzz testing or conducting black-box fuzz testing on actual physical devices represent mainstream approaches to discovering vulnerability. Dynamic analysis techniques provide contextual information during program execution; however, due to the complexity and variability of the Internet of Things (IoT) environment, as well as the inaccessibility of source code and documentation, both black-box and grey-box testing methods often struggle to achieve a comprehensive exploration of code execution paths, thereby potentially resulting in overlooked vulnerabilities. Compared to dynamic analyses, static analysis techniques can achieve higher code coverage rates given their ability to avoid executing code in an actual runtime environment. Consequently, this makes them more practical and cost-effective methods for detecting vulnerabilities in embedded firmware security. Based on the findings of [11; 12; 13] and practical analyses of existing vulnerabilities we conducted, it has been indicated that there is a specific correlation between the input parameters of the web service front end of firmware and the data-receiving functions in the boundary binary programs in the firmware. Vulnerabilities in firmware are often the result of backend binary files calling dangerous functions when processing front-end data, leading to so-called taint-style vulnerabilities. Consequently, this study adopted static analysis as its principal methodological approach, aiming to investigate taint-style vulnerabilities in embedded firmware. The efficacy of detecting taint-style vulnerabilities is largely contingent upon a robust data-dependency analysis tool. To uncover flaws, such a tool must establish a path that enables contamination to proliferate from an attacker-controlled source to a security-sensitive sink.