Zero WFuzzer: Target-Oriented Fuzzing for Web Interface of Embedded Devices

With the popularization of embedded devices, security issues continue to occur. The existing automated security testing methods for embedded devices are mainly carried out from two aspects: the Web interface of the device or the firmware binary file. This paper proposes a testing framework ZeroWFuzzer that combines the Web interface of embedded devices with firmware binary, which automatically generates test cases through the Web interface, and uses binary instrumentation to guide the fuzzing test. Experiments in embedded devices have found that ZeroWFuzzer has higher efficiency and quantity of triggering vulnerabilities than the protocol fuzzing tool Boofuzz and the Web security testing tool Xray.