# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 1 Introduction
Furthermore, there are many embedded devices with a web front-end (e.g., 83.6% in routers and 93.2% in cameras) according to the statistics we showed in Section 3.3. Hence, potential vulnerabilities can be discovered in embedded devices based on web front-end. Based on the above observations, this paper proposes a framework, named EWVHunter, with a knowledgebase guide for gray-box fuzzing, which is specifically used to detect security vulnerabilities of embedded devices. As our firmware analysis only extracts keywords related to logical judgment and web file paths from the firmware to build the knowledgebase, it does not require a full static analysis of the code in the firmware. The knowledgebase guides gray-box fuzzing based on web front-end. EWVHunter has two unique attributes. The first one is a knowledgebase built on the information extracted from the firmware, which enables us to discover vulnerabilities hidden in deep logic and also allows us to find the hidden developer interfaces without authentication. The second one is that it performs fuzzing based on the web front-end. This way of filling data on the web front-end input sources will directly reuse the original functions to produce meaningful test cases for fuzzing the target firmware. Therefore, there is no need to perform reverse analysis on the communication protocol, which can well support stateful network protocol fuzz testing. Compared with previous work [12], we can also effectively support the case of encrypted data transmission. To verify and evaluate this knowledge-guided gray-box fuzzing, we designed and implemented a fully functional prototype of EWVHunter and deployed it in an experimental environment to find authentication bypass and command injection vulnerabilities in embedded devices. EWVHunter was tested on eight real-world devices and successfully found 12 vulnerabilities, seven of which were previously unknown high-risk vulnerabilities. We reported these vulnerabilities to corresponding vendors and some of them have released feature updates. We also compared EWVHunter with WMIFuzzer, AFL, and boofuzz [14; 15; 16], and the result showed that EWVHunter performed better than them in ability, efficiency, and effectiveness. In short, we summarize the contributions of the paper as follows:  
* We proposed the first gray-box fuzzing framework based on the web front-end in embedded devices, EWVHunter, for a security analysis of embedded devices. By using the information in the official firmware and the program logic of the web front-end used as the control terminal, EWVHunter can automatically detect authentication bypass vulnerabilities and command injection vulnerabilities in embedded devices;
* We solved three challenges of fuzzing tests towards embedded devices: (1) The difficulty of testing deep layer codes and finding hidden interfaces; (2) the challenge of dealing with stateful network protocols; and (3) the problem of handling encrypted or encoded messages;
* We implemented a prototype of EWVHunter, conducted gray-box fuzzing tests on eight real-world devices and found 12 vulnerabilities, including seven unreported zero-day vulnerabilities, which affect a total of 31,996 online devices. The rest of the paper is structured as follows. In Section 2, we review the related work. Section 3 gives the background knowledge on the vulnerability discovery of embedded devices. Section 4 discusses a simple example to highlight challenges. Section 5 introduces the methods we have proposed to meet the challenges. We introduce the implementation of EWVHunter in Section 6. Section 7 describes the evaluation of EWVHunter. Section 8 discusses limitations and some possible improvements. Finally, Section 9 concludes this paper.