# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 2 Related Work  
### Dynamic Analysis-Based Approaches  
Mainstream dynamic analysis methods can be categorized into fuzz testing based on real devices [3; 4; 5] and fuzz testing in simulated environments [6; 7; 8]. Fuzz testing on real devices usually involves a black-box fuzzy test conducted using the communication protocols supported by the device. Existing black-box fuzz testing works either depend on reverse engineering [3] and modifying associated applications or on APIs [4; 15] and firmware usage documents [5] disclosed by manufacturers. This approach results in substantial blind spots within the testing process, and the functional coverage of the devices under test is notably limited. IOTFUZZER [3] analyzes the supporting application of the firmware to derive rich agreement information for communication and mutates the test case by identifying and reusing program-specific logic to discover memory damage vulnerabilities. Snipuzz [4] runs as a client communicating with the device and infers mutated message fragments based on the response. WMIFuzzer [15] captures GUI messages as an initial seed and constructs an abstract syntax tree for mutation. It can test running IoT firmware without a predetermined data model. HUBFUZZER [5] is designed for scenarios in which IoT devices and cloud back-end communication are coordinated through a hub. It utilizes messages exchanged between the hub and IoT devices to discover all functions automatically and then initiates a feature-oriented message-semantics-guided fuzz test. In the latest WiFi-security-related works [16; 17; 18; 19], wireless access points (APs) are taken as a research entry point to review the security of actual device WiFi networks, especially the security of web interfaces related to access points (APs).  
Fuzz testing based on emulation primarily relies on an emulation environment. Firmadyne [6] is a well-established emulation tool that supports ARM and MIPS architectures; however, its success rate in emulation is relatively low. Although FIRMAE [7] has greatly improved the simulation success rate compared to Firmadyne, this improvement comes at the cost of modifying firmware configuration files and detaching from the actual device operating environment, resulting in misreports. The grey-box fuzz testing tool for Internet of Things (IoT) devices, FirmAFL [8], demonstrates notable improvements in the efficiency of vulnerability mining. However, it is limited to firmware successfully emulated by Firmadyne, narrowing its applicability. Although the FirmFuzz [20] project primarily focuses on fuzzing, it employs QEMU [21] for comprehensive system emulations, resulting in significant system overhead. The implementation process of fuzzing also demands extensive expertise in emulation, diverting focus away from firmware code analysis. [PERSON] et al. [22] proposed SFuzz, which leverages coarse-grained taint propagation to eliminate paths unrelated to external inputs. It conducts forward slicing on call graphs, followed by fuzz testing on these slices. However, due to limitations inherent in the emulation platform, this methodology is solely applicable to RTOS. IoTHunter [23] employs multi-stage message generation techniques for coverage-guided grey-box fuzz testing aimed at protocols, yet it still requires feedback from emulation tools for execution. Consequently, the current state of firmware emulation technology is a significant limiting factor in advancing dynamic analysis techniques.