# Optimizing IoT Web Fuzzing by Firmware Infomation Mining
## 1 Introduction  
In the era of the IoT, from tiny smart homes to large industrial control networks, a large number of IoT devices are connected to the cloud for services [1]. Due to the limited resources of embedded devices, security issues are rarely considered, and security capabilities are lacking. In addition, the IoT device system architecture is not a general platform and lacks traditional security mechanisms [2]. Once breached, it will cause great harm. Therefore, it is necessary to conduct large-scale vulnerability detection for IoT devices. According to statistics, among the IoT devices, routers, and IP cameras with a large share have a web front-end ratio of 83.6% and 93.2%, respectively. We can see that the web entrance is widely used in IoT devices, and the web entrance integrates most of the functional operations of the device, which is more likely to have vulnerabilities. According to Gartner, more than 70% of vulnerabilities are hosted at the application layer rather than the network layer or system layer [3], so vulnerability detection for IoT web entrance is an effective way to discover vulnerabilities. Among various vulnerability discovery methods, fuzzing [4] is very suitable for large-scale automated vulnerability detection because of its high scalability, high degree of automation, and low false-positive rate. Current study [5; 6; 7] can generally be divided into three stages: (1) Seed generation: In order to generate an initial seed that conforms to semantics, most of the current work uses simulation [8] or physical devices to run the firmware. Then, automatically traversing the front-end web pages through a web crawler [9] while capturing traffic as seeds. (2) Fuzzing: After obtaining the initial seeds, the seeds will be mutated and sent to the device's web entrance for testing. At the same time, vulnerabilities can be discovered using side channels or by monitoring the simulated environment. (3) Schedule: The scheduling part calculates data such as the basic blocks coverage and the number of function calls inthe fuzz process, then adjusts the direction of the fuzz in real-time, thereby accelerating vulnerability discovery. However, the existing IoT web fuzzing technology still faces the following two challenges:  
Challenge 1: It is not easy for crawlers to cover all front-end pages and interfaces, resulting in incomprehensive test cases and low coverage. The purpose of crawlers is to access as many pages and interfaces as possible, each of which corresponds to a potentially vulnerable function entry on the back end. However, the flexibility of web technology makes the rules of web crawlers unable to cover all possible situations. In addition, crawlers cannot find hidden interfaces that are not displayed on the front-end, pages that are not connected to the crawler entrance, or pages dynamically generated by js scripts, etc. Ultimately, the coverage of crawler is low, and it is impossible to find bugs in uncovered function entries. Challenge 2: Lack of scheduling mechanism or too much overhead for scheduling. The existing scheduling mechanism [7] first performs dynamic testing on all test cases and counts the corresponding kernel logs. However, the key factor affecting the speed of fuzzing is the low throughput of the simulation environment, coupled with the frequent reading of the kernel log, which puts forward higher requirements on the amount of computation. Although the final result shows that the discovery of vulnerabilities is accelerated, sorting test cases also takes up much time. These two challenges have limited IoT web fuzz's vulnerability discovery ability and speed. We believe this is because state-of-the-art research does not provide enough information to guide fuzz, resulting in fuzz to be blind and inefficient. Inspired by static analysis, we recognize the need to dig deeper into the firmware for helpful information to guide fuzz. In this paper, we propose IoTParser, aiming at improving vulnerability discovery capabilities and speed of vulnerability discovery.