# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 7 Evaluation
### Comparison with Existing Work
#### 7.4.2 Efficiency

Table 8: Statistics for web front-end analysis of embedded web front-ends. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Vulnerability Type** & **Vul-CVE-ID** & **Device** & **EWVHunter** & **AFL Patched** & **Bootfuzz Patched** \\ \hline \multirow{7}{*}{Command injection} & CVE-2017-6077 & Netgear DGN2200 & 1 h 14 min & 15 h 24 min & 3 h 12 min \\ \cline{2-5}  & CVE-2019-5071 & Tenda AC9 & 56 min 45 s & 3 h 42 min & 42 min 12 s \\ \cline{2-5}  & CVE-2019-5072 & & 47 s & 3 h 43 min & 43 min 12 s \\ \cline{2-5}  & CVE-2019-17508 & D-Link DIR-850L & 3 h 42 min & NA & NA \\ \cline{2-5}  & CVE-2019-17509 & & 2 h 11 min & NA & NA \\ \cline{2-5}  & unassigned 1 & \multirow{2}{*}{D-Link DIR-846} & 8 min 27 s & NA & NA \\ \cline{2-5}  & unassigned 2 & & 7 min 44 s & NA & NA \\ \hline \multirow{7}{*}{Authentication bypass} & N-day & Netgear DGN1000 & 28 min 33 s & 19 h 6 min & 13 h 29 min \\ \cline{2-5}  & CVE-2018-7034 & Trendnet TEW-733 GR & 45 min 01 s & 21 h 17 min & 18 h 6 min \\ \cline{2-5}  & CVE-2019-17511 & D-Link DIR-412 & 3 min 29 s & 5 min 42 s & 3 min 48 s \\ \cline{2-5}  & CVE-2019-17505 & D-Link DAP-1320 & 3 min 11 s & 5 min 12 s & 3 min 11 s \\ \cline{2-5}  & CVE-2019-17373 & Netgear DGN2200 & 25 min 17 s & 17 h 30 min & 52 min 18 s \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Statistics on comparison of efficiency in finding vulnerabilities. We conducted an artificial analysis of the experimental results and found that there were several things worth paying attention to:  
1. Neither the AFL nor the original versions of boofuzz were able to detect command injection and authentication bypass vulnerabilities. The main reason is that they did not have a detection strategy. After adding EWVHunter's remote detection strategies and using the request message generated by EWVHunter as a seed, AFL Patched and boofuzz Patched could detect these two kinds of vulnerabilities. However, without the knowledgebase built in this paper, AFL Patched and boofuzz Patched would difficult to find this vulnerability in 24 h;
2. The AFL patch and Boofuzz patch used the site map built by EWVHunter, so they could find authentication bypass vulnerabilities in D-Link DIR-412 and D-Link DAP-1320. Without the site map in the EWVHunter knowledgebase, they would not be able to find both interfaces. That shows that the knowledgebase constructed in this paper could effectively expand the breadth of fuzzing for embedded devices;
3. EWVHunter had the highest test efficiency. It took longer for AFL Patched to detect a vulnerability than boofuzz Patched, mainly because AFL Patched generated a lot of useless test data. Boofuzz Patched used the data model as a guide to generate structured messages. So the test cases generated by boofuzz Patched were more effective. Compared with AFL Patched and boofuzz Patched, EWVHunter filled data on the web front-end input sources. Therefore, most of the data generated were messages that the embedded device could accept and process. So our testing efficiency was higher;
4. For D-Link DIR-846 and DIR-850L, their protocol had status. Our EWVHunter could detect vulnerabilities, but AFL Patched and boofuzz Patched could not;
5. The two vulnerabilities in Tenda AC9 were on the same page and caused by similar reasons. So, the fuzz scheduling strategy in this paper could help us quickly find the vulnerability in the second location. Although the three vulnerabilities of D-Link DIR-846 were not on the same page, they could be quickly detected using the same type of payload. This shows that our fuzz strategy allowed EWVHunter to find the same type of vulnerability quickly after finding the first vulnerability.