| 名称 |
Read Sensitive Constants Within an Executable |
|
|
| 摘要 |
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis. |
| 前置条件 |
Access to a binary or executable such that it can be analyzed by various utilities. |
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-798 |
Use of Hard-coded Credentials |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-167 |
An attacker discovers the structure, function, and composition of a type of computer software through white box analysis techniques. White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revealing at least a portion of its machine instructions that can be observed upon execution. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1552.001 |
Unsecured Credentials:Credentials in files |
|