# Optimizing IoT Web Fuzzing by Firmware Infomation Mining
## 2 Firmware Information Mining
### Interfaces and Page Paths Extraction  
The page path refers to the web path of all files in the webroot directory. Generally, the web path of the back-end files in the web service is the path relative to the webroot directory. For some test pages or independent pages that have no jump relationship with other pages, the web crawlers cannot find them, and the action forms and interfaces of these pages will be missed. In addition, some IoT devices have imperfect permission restrictions on back-end static files. Directly accessing the page path through the front-end will lead to leakage of sensitive information or leakage of operation interface [13]. For example, in CVE-2021-33251, \"model.cgi\" of Qihu360-F5C will leak the device's mac address and firmware version due to a lack of permission restrictions. It should be noted that the CGI files of some devices are not located in the webroot directory. We will also match them to obtain the file name and add it to the page paths. The interface refers to the function entry of a web service. For example, \"/ajax_ddnscode.asp\" is the configuration interface of \"DDNS\" in the ASUS RT-N53 router. In addition to the file format, some are in the form of routing, such as \"/index/home\". the back-end service will resolve the route to the corresponding function entry for processing. IoT web fuzzing needs to find as many interfaces as possible for testing. Each function entry corresponds to a set of processing logic in the back-end, and there may be vulnerabilities. Due to the flexibility of front-end technology and the limitation of front-end resources, web crawlers cannot obtain all function entries, resulting in low coverage of crawlers, which will miss many potential vulnerabilities. However, all of these can be found in the back-end source code. After decompressing the firmware, we can obtain web-related front-end and back-end files, such as HTML, JS, ASP, CGI, and Httpd. For different file types, we summarize the structures and functions related to interfaces in their grammar rules to extract them in a targeted manner. For HTML files, HTML files are composed of various front-end components. For the attributes of different components, we extract the values of attributes related to the interface. For example \"href\" attribute means jumping to a new page or interface, \"action\" attribute means sending the form content to the interface it points to. PHP, ASP, JSP, and other back-end development languages have their jump functions, such as \"header\", \"redirect\", \"sendRedirect\", etc. [14]; other than that, the more common way is to construct the web page and hand it over to the browser to process. Therefore, in addition to the matching of jump functions, we also use regular matching to extract possible interfaces. The role of XML files in web interfaces is mainly used for XML-based services, such as SOAP. The format is relatively fixed so that the interfaces can be extracted through regular expressions according to the service format. For js files, its content is javascript code, not only in js files, PHP, HTML, and ASP also use some javascript code for dynamic processing. For the javascript code in all files, we also summarize the interface-related technologies in javascript, such as \"XMLHttpRequest\", \"jquery Ajax\", \"fetch\", and other data request technologies [15]. Since there are many public js libraries that provide basic services in js, such as \"jQuery\", we exclude js files that are referenced by various files for more than a certain number of times based on experience. For some unreadable files, such as CGI files and back-end binary files,we extract potential interface information by regular matching of binary strings contained in them. As for the page paths, after decompressing the firmware, we first locate the webroot directory by locating the front-end files and then traverse all the files in the webroot directory to obtain the web path relative to the webroot directory.