# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 5 EWVHunter
### Trigger the Vulnerability by Fuzz Testing
\(K\) _is the key information dictionary extracted from firmware and used to extend the depth and breadth of fuzzy testing by satisfying the program logic condition;_
4. \(S\) _is the website map in which_ \(u\in S\) _is called the URL;_
5. \(M\) _is the set of the activity path graph:_ \(M_{i}\in M\) _in which_ \(g\in M_{i}\) _is called a path on the activity path graph._  
```
Input:\(g\): a path in the activity path graph \(P\): set of payloads in the knowledgebase \(K\): set of key informations in the knowledgebase
1\(D\) = {\(d_{1}\), \(d_{2}\),..., \(d_{n}\)} = get_input_sources_from_path(\(g\)) ; // a set of input sources on an activity path graph
2\(positionSet\) = {\(a_{1}\), \(a_{2}\),..., \(a_{m}\)} = get_position_combination_set(\(D\)) ; // a set of various combinations of filled positions,(\(m\)=2\")
3 whilepositionSet not Nulldo
4\(positionList\) = {\(p[l_{1},pl_{2}\),...,\(pl_{i}]\) = random_get(\(positionSet\)) ; // positionList is an element randomly selected in positionSet, and this element will be removed from the set after selection. positionList is a combination of filled positions in which \(pl_{i}\in positionList\) is called a filled position. 5 fill_data_to_input_source(\(positionList\), \(mutation(P)\), \(K\)) ; // The mutation will be based on the strings in P, and the strings will be filled in the position in the positionList
6 ordered_trigger_event(\(g\)) ; // After filling the web front-end input sources, the EWWunter triggers the event according to the event trigger path indicated by \(g\)
```  
**Algorithm 2**EWVHunter Input Sources Random Fuzzing Algorithm  
**Fuzz strategy. ** There are two strategies for fuzzing, one is generation-based fuzzing and the other is based on mutation. Generated fuzzing needs knowledge of the format of the target to create test cases. Mutation-based fuzzing makes small changes based on the seed with the type information. However, the protocol targeted in this article is highly-structured data. If the traditional method of random byte mutation on a binary file is adopted, numerous invalid test cases will be generated and using fuzzing to detect deeper code layer vulnerabilities is challenging. So the mutation strategy implemented by EWVHunter is to fill the mutation data from input sources based on the knowledgebase. Specifically, the mutation strategy used in this article is as follows:1. **The input source mutation is based on payloads in the knowledgebase. ** This article focuses on command injection vulnerabilities and authentication bypass vulnerabilities. We observed a critical message that the command injection vulnerability mainly relies on injecting a valid payload from a data source. Therefore, this feature can be used to build an active payload dictionary for vulnerability discovery. To this end, we combined the open-source project FuzzDB [44], PayloadsAllTheThings [45], and the command injection vulnerability payload disclosed in the CVE (Common Vulnerabilities and Exposures) vulnerability library to build a payload dictionary. FuzzDB and PayloadsAllTheThings are two open-source projects that integrate payloads for vulnerability discovery and are used in most security tools. The vulnerability payloads in the CVE vulnerability database are a manifestation of the security research experience. It is easy to have similar vulnerabilities for similar input points in embedded devices, so these payloads have an excellent detection effect. EWVHunter mutates each byte in the payload based on this payload dictionary and then uses the mutated data to fill the input sources;
2. **Filling strings from key information dictionary in the knowledgebase into the input source. ** In the knowledgebase, we built a key information dictionary extracted from the firmware to fill the input sources. The reason why this dictionary is used to fill the input fields in the web front-end is that we want the seeds to discover the device program hidden logic (the breadth of fuzz testing).