# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 5 EWVHunter
### Trigger the Vulnerability by Fuzz Testing  
We fill data into the web front-end input sources at runtime to solve the problem of stateful network protocol and transmission message encryption in fuzzing. The values accepted by the input sources in the embedded web front-end usually consist of hard-coded characters, user input, and return values from system APIs. From the web front-end point of view, these three contents can be modified. The stateful network protocol is a communication process between the client and embedded device. If we use reverse analysis and rewrite the program to achieve this process, it is undoubtedly very challenging. Therefore, we fill the data that need to be used in the protocol message from the input sources. After that, our framework will trigger web front-end events according to the activity path graph and reuse the original program logic in the process. After being processed by the original program logic, these data will become protocol fields and then be sent to the embedded device. We modify the protocol field parameters from the embedded web front-end to generate communication messages, which has two benefits:  
1. For stateful network protocols or communication message encryption, the fields can be fuzzed before the program processes them;
2. Without the reverse analysis of the protocol implementation, the fuzzing of unknown protocols can be completed. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Events** & **Button** & **Select** & **Input** & **a** & **Textarea** & **Span** & **td** & **tr** & **div** \\ \hline click & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ dblclick & ✓ & x & x & ✓ & x & x & x & x & x \\ change & x & ✓ & ✓ & x & ✓ & x & x & x & x \\ mouseup & ✓ & ✓ & x & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ mousedown & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ keyp & ✓ & x & ✓ & x & ✓ & x & x & x & x \\ keydown & ✓ & ✓ & ✓ & ✓ & ✓ & x & x & x & x \\ blur & x & ✓ & x & ✓ & x & x & x & x & x \\ focus & x & x & ✓ & x & ✓ & x & x & x & x \\ scroll & x & x & x & x & x & x & x & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Events common on HTML tags. Figure 7: Activity path graph. The circle node represents an event. Inputs between events are marked on the wires of the nodes. **Fuzz scheduling. ** If all protocol fields are mutated at the same time, the constructed message is likely to be a message that does not conform to the device processing logic. As a result, the probability of rejection by embedded devices is high and fuzz testing is invalid. In this case, we designed a fuzz testing scheduling algorithm to assign the web front-end input sources to be filled, as shown in Algorithm 2. For each message, we want to randomly select a subset of the fields for mutation, not all fields. In particular, firstly, we extract the input sources set \(D\) from an activity path. Then we take the concept of combinatorial number and use all combinations of the input sources in the web front-end to build a filled position set \(positionSet\). As the activity path that can trigger network requests to improve the efficiency of fuzzing will be used, the set \(positionSet\) is also a set of input points on an activity path. We will then randomly select the elements \(positionList\) from the set \(positionSet\), which identifies which input points will be filled. Finally, the fuzzer can complete the mutation based on the strings in \(P\) in Definition 1 and fill this mutation strings into the input sources specified by the set \(positionList\). The network request will be sent after the last event on the activity path is triggered. **Definition 1**. : _The knowledgebase constructed in this paper and used to guide fuzz testing is a 5-tuple \(KB\) = (\(P\), \(H\), \(K\), \(S\), \(M\)), where:_  
1. \(P\) _is the payload dictionary used to fuzz the embedded devices in which_ \(p\in P\) _is used as initial mutation strings;_
2. \(H\) _is the heuristic dictionary used to fill input sources to build the activity path graph;_
3.