# SloTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation
## 1 Introduction
However, the blackbox fuzzing receives a limit on the throughput of the device processor and will generate many more invalid test cases without feedback. These invalid test cases are not helpful for fuzzing and they take more time. At the same time, if the device does not receive the stateful message and is not in a state to accept messages, the device will refuse service or interrupt the connection. As a result, it is ineffective to continue sending mutated messages. Furthermore, some internal parameters depend on the previous message. When these parameters are mutated, these messages will also be rejected. According to these issues, detecting vulnerabilities through blackbox fuzzing is low in efficiency and effectiveness. Motivated by the above description, this paper leverages generation-based fuzzing technology to perform blackbox testing automatically. In our work, we propose a stateful message generation (SMG) mechanism to generate more valid test cases, which can improve the efficiency and effectiveness of fuzzing. SMG addresses two challenges, including the maintenance status of a device and the mutation of parameter dependency messages. Since the devices have many I/O operations, the status of a device consists of a physical state and a protocol state. When the physical state is abnormal, the device needs to be maintained manually. In a message sequence, if a message has an inappropriate protocol state, the device will not be able to accept the subsequent messages in this sequence. Our work mainly solves the state problem of the protocol. We analyze the front-end of an IoT device's web interface to build initial seeds and generate test cases. Due to the difficulty of firmware operation monitoring, we can analyze operating interfaces to obtain prior knowledge. This knowledge will help us test devices more comprehensively. We adopt a multi-message seed format, and every seed contains a complete sequence of operations. Based on Boofuzz [12](a popular protocol fuzzer), we design a blackbox fuzzing tool called SIoTFuzzer which can detect IoT device vulnerability. By building a simulation environment, it is more suitable for analyzing the web management interface and constructing the input of an IoT device. Finally, vulnerabilities can be discovered through device monitoring deployed in the system or built in the simulator. In order to validate and evaluate this blackbox fuzzing, SIoTFuzzer was designed and implemented for discovering vulnerabilities in IoT devices automatically. The test objectives are mainly routers and IP cameras. These devices are based on MIPS or ARM architecture, and they also have a web interface. To verify the improvement of our seed generation and mutation strategy, we set up a control group to prove that our optimization is effective. Compared with FirmFuzz [13], the latest device blackbox fuzzing test tool, SIoTFuzzer has a greater vulnerability discovery capability. In summary, we make the following contributions in this paper:  
1. For addressing two difficulties in detecting vulnerabilities in IoT devices, including the maintenance status of devices and keeping parameter dependency between messages, we adopt stateful message generation (SMG). In addition, we adopt a multi-message seed format and deploy a corresponding mutation strategy to guide fuzzing;
2. We design and implement a blackbox fuzzer called SIoTFuzzer (with open-source code available at [[https://github.com/yinfeidi/SIoTFuzzer](https://github.com/yinfeidi/SIoTFuzzer)]([https://github.com/yinfeidi/SIoTFuzzer](https://github.com/yinfeidi/SIoTFuzzer)) (accessed on 27 March 2021)) for fuzzing IoT devices. Through analysis of the device web interface, we can obtain prior knowledge of web elements. SIoTFuzzer traverses the device web pages and obtains normal communication messages. These messages will be used for fuzzing;
3. We evaluated SIoTFuzzer on 9 IoT devices and 12 known vulnerabilities were found.