LLM-Augmented Semantic Analysis for Hidden Web Interface Discovery in IoT Devices

With the widespread use of Internet of Things (IoT) devices, hidden Web interfaces have become one of the core security threats. These interfaces often lack authentication, making them prime targets for attackers to steal sensitive information or manipulate devices. Existing solutions only analyze the security of publicly exposed Web interfaces and cannot effectively identify deeply embedded private interfaces. To address these challenges, we propose HWISeeker, a novel solution that combines static analysis and semantic reasoning techniques to discover and verify hidden Web interfaces in IoT devices automatically. Specifically, HWISeeker filters the key keywords associated with the interfaces through heuristic rules and semantic analysis, employs a control flow backtracking algorithm to restore the logical relationships of the keywords, and finally assembles and validates the legitimacy of the interfaces using black-box fuzzing. HWISeeker was evaluated on nine commercial IoT devices and successfully identified 175 hidden Web interfaces, achieving 2.8 times the detection capability of the current state-of-the-art solution, IoTScope. Furthermore, 23 vulnerabilities were detected, 18 of which have been assigned CVE IDs.