# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 5 EWVHunter
### Web Front-End Analysis and Activity Path Graph Construction  
Since our goal is to discover security flaws in embedded devices, we only focus on those events related to network requests in the web front-end. Therefore, the purpose of web front-end analysis is to determine which trigger path for the web front-end event can send an HTTP request when the last event on the path is triggered. Besides, we develop simple triggering strategies to build the activity path graph to promote efficiency in the fuzzing phase. The web page loading takes time and this time may be related to many factors. If we cannot accurately grasp the loading status of the page for analysis, the information analyzed is inaccurate or invalid. Furthermore, network-related resources can be loaded for a long time or cannot be loadeddue to network congestion. If the fuzzer waits for such resources to load, it will seriously affect the efficiency of fuzz testing. To improve the fuzzing efficiency, we determine whether the loading state of the page meets the requirements for starting the web front-end analysis using the algorithm as shown in Algorithm 1. There are three web front-end events directly related to page loading, namely load, DOMContentLoaded and networkAlmostIdle. The load event is fired when the whole page has loaded, including all dependent resources. The DOMContentLoaded event is used to indicate that the initial HTML document has been fully loaded and parsed, but it is not sure whether the style sheet, image, and child frame have finished loading. The networkAlmostIdle event is used to determine if any network requests have not been completed. Before the browser fully displays the web page, it needs to make a series of network requests with the server to get all the resources presented by the web front-end. After understanding the role of these three events and analyzing the page loading situation in various network situations, we set the following priorities for these three events, and judge the page loading situation based on ensuring efficiency and accuracy. We set the load event priority here, the DOMContentLoaded event second, and the networkAlmostIdle last. In particular, firstly we set a flag \(F\) to indicate whether web front-end analysis can begin. Then we send a network request. Finally, we monitor the loading of web resources, set the time to wait for each event to complete and determine the completion of the event. If the value of \(F\) is set to 1, we end the observer of the web front-end loading event and start the web front-end analysis. ```
Input:\(u\): URL of the target device Output:\(F\): The flag determining whether page analysis is possible
1 initial \(F=0\);
2 send_requests(\(u\)); // waiting for the page load event according to the following strategy after sending the request ifThe \"load\" event completedthen
3 if\(F\) = 1 ; // The F value shows that we can start web front-end analysis
4 elseifWait for the \"load\" event to timeout && The \"DOMContentLoaded\" event completedthen
5\(F\) = 1;
6 elseifWait for the \"DOMContentLoaded\" event to timeout && The \"networkAlmostIdle\" event completedthen
7\(F\) = 1;
8 return \(F\);
```  
**Algorithm 1**Page load state detection algorithm  
After making sure that the page is fully loaded, we can start the web front-end analysis. In order to fuzz every request from the web front-end to the embedded device entirely and efficiently, we build an activity path graph. We first analyzed the common binding events on the front-end HTML tags (as shown in Table 3). These events are commonly used to trigger page changes or send network requests. These events are also often associated with codes that implement the stateful network protocol or communication encryption. Later, a simple strategy is formulated according to the common execution order of events. The strategy is to traverse (e.g., all options of the select event) and trigger all web front-end events. When our fuzzing framework encounters the input source, it will use the heuristic dictionary in the knowledgebase to fill it.