# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 7 Evaluation
### Real-World Case Study  
The DIR-850L Wireless AC1200 Dual-Band Gigabit Cloud Router is a compelling case. Users can access the web front-end for management through a browser. The device's firmware has been released on the official website and can be unpacked using binwalk. Its web front-end consists of HTML and JavaScript, and the web page handle implementation is a combination of modified PHP and CGI. There are currently no tools to analyze the modified web page handle composed of PHP and CGI. So we used EWVHunter to fill data in the web front-end input sources and to perform gray-box fuzzing. The format of the protocol transmission data is XML, and its protocol status is reflected in the relevancy in context. If we modify the transmission information by capturing and replaying packets, it will be invalid for setting the input point of D-Link's Internet time server in the \"tools_time.php\" page. Figure 9 shows that the modified value at the server tag in the packet and replay the data. Although after replaying the data packet, a response was given with a status code of 200, and resulted in a reasonable response result. However, according to the results displayed on the page, it was still the previous value \"ntp1.dlink.com\", and it had not changed. Figure 10 shows the web front-end after replaying that data packet. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Device Type** & **Vendor** & **Device Model** & **Firmware Version** & **Page Handle** & **Protocol and Format** \\ \hline \multirow{8}{*}{Router} & \multirow{3}{*}{D-Link} & DIR-859 & A3-1.06 & php + cgi & HNAP, XML \\ \cline{3-5}  & & DIR-846 & 100A35 & php + cgi & HNAP, JSON \\ \cline{2-5}  & & DIR-412 & A1-1.14 WW & php + cgi & HNAP, XML \\ \cline{2-5}  & & DAP-1320 & A2-V1.21 & cgi & HNAP, XML \\ \cline{2-5}  & & DGN2200 & 1.0.0.58 & cgi & HTTP, key-value \\ \cline{2-5}  & & DGN1000 & 1.1.00.48 & cgi & HTTP, key-value \\ \cline{2-5}  & & Trendnet & TEW-733 GR & v1.03 & php + cgi & HTTP, key-value \\ \cline{2-5}  & & Tenda & AC9 & 2.22.15 & cgi & HTTP, key-value \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of embedded devices under testing. Figure 9: Modify and replay the packet. The reason for the case is that after sending a data packet to the interface \"hedwig.cgi\", the web front-end sent another data packet to the \"service.cgi\" interface to complete the setting. Therefore, the state of the protocol is reflected in relevancy in context. If we adopt the method of populating data at the input sources, we can automate this process and let our data be received and processed by the embedded device. Next, we manually demonstrated the process of filling data at the input sources, triggering, and verifying the vulnerability in Figure 11.  
The command injection vulnerability was reported after 42 min 34 s. We analyzed the cause of the vulnerability and why EWVHunter could find it. The discovery of the \"tools_time.php\" page relied on the site map in our knowledgebase. The \"Automatically synchronize with D-Link's Internet time server\" option on the web front-end was disabled by default. Therefore, if we wanted to automatically trigger the vulnerability, using a violent UI trigger method was not feasible. According to the activity path constructed by EWVHunter, first, the automatically synchronize option needed to be turned on. Then input value of the selection box needs to be set, and this step is to fill mutation data at the input sources. Finally, the \"Update Now\" button was selected to complete the network request trigger. The mutated data was transmitted to the embedded device after the program processing and received and processed by the device. The payload that could trigger this vulnerability is \"a; (echo?9f61408e3 afb633e50 cdf1b20 de6f466? /htdocs/web/pic/x.jpg)&exit;\". The hash value of the md5 algorithm could enhance the accuracy of vulnerability verification.