# SloTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation
## 5 Framework of SloTFuzzer
### Mutation Strategy
#### 5.1.1 Parameter Mutation  
Parameter mutation is used to trigger memory-related vulnerabilities and command injection vulnerabilities. To ensure that the message sequence is completely accepted and data are transmitted to the device server, we mainly mutate the message parameter. For protocol messages, a parameter usually contains nodes and values. Therefore, parameter mutation includes parameter node mutations and value mutations. Before the mutation proceeds, the parameters in the message need to be parsed with a parameter dictionary. In particular, when multi-step messages are mutated, we mark the verification message and  
Figure 6: (**a**) The structure of multi-message seed. (**b**) The format of messages consisting of seeds. Figure 7: Framework of SloTFuzzer. verification field and do not mutate this part. We adopt node mutation first and then value mutation. For node mutation, we randomly select a parameter position, and perform the following operations on this parameter node:  
* **N1**: delete this node;
* **N2**: repeat this node. The purpose of this step is to test whether the server will generate an error if a parameter is assigned multiple times in a statement;
* **N3**: select one parameter from the non-form parameter library and insert it at this position. If the server lacks verification of the non-form parameter and an illegal value is passed in, the device will crash. ```
the set of seed messages, Seed; the set of node mutation method, \(N\)-\(Mutation\{N1,N2,N3\}\); the set of value mutation method, \(V\)-\(Mutation\{V1,V2,V3,V4\}\); the set of structural mutation method, \(S\)-\(Mutation\{S1,S2,S3,S4\}\); //determined phase \(seed_{i}\) = random(\(Seed\)) // randomly select a seed split \(seed_{i}\) to messages set \(\{M_{1},M_{2},\)...,\(M_{n}\}\) for each \(M_{i}\)! = \(M_{1}\) and \(M_{i}\)\(\epsilon\)\(M\)do \(P\) = message-parameter(\(M_{i}\)) // get the set of parameters from message \(P_{i}\) = random(\(P\)) // randomly select a parameter for each \(Mutation\)\(\epsilon\)\(\{N\)-\(Mutation,V\)-\(Mutation\}\)do \(Mui\) = random(\(Mutation\)) // randomly select a mutation method \(P_{i}\) = mutation(\(Mui_{i}\), \(P_{i}\)) //mutate the message parameters endfor \(S_{i}\) = random(\(S\)-\(Mutation\)) \(seed_{i}\) = mutation(\(S_{i}\), \(seed_{i}\)) //mutate the structure of the seed endfor \(testcase\) = script-generated(\(Seed_{i}\)) \(result\) = sending-detection(\(testcase\)) ifinteresting(\(result\))then  alert(\(result\)) endif //random phase for\(M_{i}\)\(\epsilon\)\(M\)do operation= random(\(N\)-\(Mutation\), \(V\)-\(Mutation\), \(S\)-\(Mutation\)) \(testcase\) = mutation(\(operation\), \(Seed_{i}\)) endfor \(testcase\) = script-generated(\(Seed_{i}\)) \(result\) = sending-detection(\(testcase\)) ifinteresting(\(result\))then alert(\(result\)) endif
```  
**Algorithm 1** SeedMutation(_Seed_, \(N\)-\(Mutation\), \(V\)-\(Mutation\), \(S\)-\(Mutation\)_)  
For value mutation, we randomly select a parameter position, and perform the following operations on the value of this parameter node:  
* **V1**: extend the data content. This step includes two methods. The first is to increase the data length for the data content in the form of characters. This step generally uses multiple copies of the original string or directly fills a character to the maximum length to trigger the buffer overflow vulnerability. The second is to add execution commands after the data, including ping, reboot, or execute a script. Before the device simulation runs, we will execute the script into its file system. * **V2**: clear the data content. If the web server lacks non-empty verification, this operation will trigger related vulnerabilities;* **V3**: replace digital data in the boundary integer. This operation might trigger possible data verification errors. Since the HTTP protocol is text-based, we use heuristic rules to judge the field style. * **V4**: change the content type. This operation might trigger vulnerabilities about assumptions on the data type.