# Optimizing IoT Web Fuzzing by Firmware Infomation Mining
## 3 IoTParser  
The architecture of IoTParser is shown in Figure 5, which can be divided into three parts, namely web crawler, static analysis, and fuzzer.  
First, we decompress the firmware. Then, through the static analysis, we can obtain the interfaces, page paths, and shared keywords dictionary. After that, we emulate the firmware. The web crawler automatically traverses all the function entries of the web interface through the proxy and uses the request captured as the initial seeds. For the interfaces and page paths obtained in the static analysis of the firmware, if they do not exist in the seed queue, the crawler will crawl and parse the interfaces and pages, then add them to the seed queue to obtain a high-coverage seed queue. Using the shared keyword dictionary, we calculate  
Figure 4: The set of extracted shared keywords in ASUS RT-N53 router.  
the weight information of the seed queue, then mutate the seeds with higher weights first, and, finally, generate the seed priority queue. Next, the fuzzer performs fuzzing in the order of the priority queue and finally outputs a vulnerability report.  
We use FirmAE [8] with a high simulation success rate to simulate the firmware, and the crawler module uses the popular web crawler tool RAD [17]. At the same time, the interfaces and page paths extracted by the firmware static analysis module can supplement the web crawler to increase the coverage. We transform the fuzzer module based on the popular web fuzzing tool W13 scan [12]. Compared with the state-of-the-art tool boo-fuzz [18], W13 scan is more suitable for web protocols, without the need to write templates, and can send more targeted packets.  
After the seed priority queue is generated, we mutate the initial request to generate a test queue according to the priority. There are three mutation strategies: (a) delete parameter value; (b) replace parameter value with vulnerability payload; and (c) add vulnerability payload after parameter value. Because web-type vulnerabilities are different from memory-type vulnerabilities, the vulnerability payload usually needs to meet certain grammar rules rather than being randomly generated. Therefore, we use vulnerability payload dictionaries for fuzzing, such as fuzzDict [19].  
IoTParser supports the detection of four types of vulnerabilities in IoT devices: overflow, command injection, XSS, and unauthorized access. For different vulnerability types, we have designed vulnerability monitoring methods according to the vulnerability characteristics [20].  
1. Overflow. By monitoring the running log of the simulation environment, when a memory access error occurs, it can be judged whether an overflow has occurred by performing keyword matching on the log.
2. Command injection. Before the simulation, we inserted a probe into the firmware simulation environment. When command injection occurs, the probe will generate a log file to help us detect command injection vulnerabilities.
3. XSS, matching whether the page response contains a specific string.
4. Unauthorized access. After removing the authentication fields in the request, such as \"cookie\", \"Authorization\", etc., if the request without authentication status can still obtain the same return information as before, it can be judged that there is an unauthorized vulnerability.