Abstract:Abstract SOHO (small office/home office) routers provide services for end devices to connect to the Internet, playing an important role in cyberspace. Unfortunately, security vulnerabilities pervasively exist in these routers, especially in the web server modules, greatly endangering end users. To discover these vulnerabilities, fuzzing web server modules of SOHO routers is the most popular solution. However, its effectiveness is limited due to the lack of input specification, lack of routers’ internal running states, and lack of testing environment recovery mechanisms. Moreover, existing works for device fuzzing are more likely to detect memory corruption vulnerabilities.In this paper, we propose a solution ESRFuzzer to address these issues. It is a fully automated fuzzing framework for testing physical SOHO devices. It continuously and effectively generates test cases by leveraging two input semantic models, i.e., KEY-VALUE data model and CONF-READ communication model, and automatically recovers the testing environment with power management. It also coordinates diversified mutation rules with multiple monitoring mechanisms to trigger multi-type vulnerabilities. With the guidance of the two semantic models, ESRFuzzer can work in two ways: general mode fuzzing and D-CONF mode fuzzing. General mode fuzzing can discover both issues which occur in the CONF and READ operation, while D-CONF mode fuzzing focus on the READ-op issues especially missed by general mode fuzzing.We ran ESRFuzzer on 10 popular routers across five vendors. In total, it discovered 136 unique issues, 120 of which have been confirmed as 0-day vulnerabilities we found. As an improvement of SRFuzzer, ESRFuzzer have discovered 35 previous undiscovered READ-op issues that belong to three vulnerability types, and 23 of them have been confirmed as 0-day vulnerabilities by vendors. The experimental results show that ESRFuzzer outperforms state-of-the-art solutions in terms of types and number of vulnerabilities found.

T-Reqs: HTTP Request Smuggling with Differential Fuzzing

The HTTP Garden: Discovering Parsing Vulnerabilities in HTTP/1.1 Implementations by Differential Fuzzing of Request Streams

Excalibur: A Scalable and Low-Cost Traffic Testing Framework for Evaluating DDoS Defense Solutions.

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

Toward Scalable and Low-Cost Traffic Testing for Evaluating DDoS Defense Solutions

SRFuzzer

Attacking Websites: Detecting and Preventing HTTP Request Smuggling Attacks

Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications

Off-Path Attacking the Web

No Peer, no Cry: Network Application Fuzzing via Fault Injection

ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-Type vulnerabilities

1Dfuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing.

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Revery

ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing

HDiff: A Semi-automatic Framework for Discovering Semantic Gap Attack in HTTP Implementations

ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing

BackREST: A Model-Based Feedback-Driven Greybox Fuzzer for Web Applications

Revery: From Proof-Of-Concept To Exploitable (One Step Towards Automatic Exploit Generation)

RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface