Hardcoded storage

Question 1

What is hard coding

Answer 1

Data is directly embedded into the source code of a program as opposed to obtaining the data from external sources(files or databases) or generating it at runtime

Question 2

What piece of information do hard-coded data usually represent?

Answer 2

unchanging pieces of information, such as physical constants, version numbers and static text elements

Question 3

What does soft-coded data encode?

Answer 3

Information like user input, HTTP server responses, or configuration files, determined at runtime

Question 4

How can hard coded data be modified?

Answer 4

By editing the source code and recompiling the executable

Question 5

Advantages of hard-coded storage

Answer 5

Fast delivery of code - it can resolve, in the short term, the pressure to deliver code

Question 6

Disadvantages of hard-coded storage

Answer 6

Considered an anti-pattern.
Hard to adapt
Hard to internationalise
Raises security vulnerabilities

Question 7

What is the source code disclosure issue?

Answer 7

When the code of the web application is exposed to the public.
Enables attackers to understand how the application behaves by simply reading the code and checking for logical flaws, or hardcoded username/password pairs, or secret keys.
Severity depends on how much code is exposed and how critical the leaked lines of code are for the security of the web application.

Question 8

Hidden form fields

Answer 8

Used in web pages to pass information about the current page to the server.
For example, if the user fills out an enquiry form, we may want to obtain their IP address using the scripting language PHP.
May also want the URL of the referring page

Question 9

What do hidden fields allow us to send?

Answer 9

All kinds of information, along with form data entered by a user, without the user having to be involved in the process.
Can also be used to pass information back to scripts - may include security tokens or name of a relevant entry in a database

Question 10

Software reverse engineering

Answer 10

Involves reversing a programs machine code back into the source code that it was written in, using a program languages statements.

Question 11

Why is software reverse engineering, to retrieve the source code of a program, done?

Answer 11

Source code lost
Study how program performs
Improve performance
Fix a bug
Identify malicious content in a program such as a virus
Adapt a program written for use with one microprocessor for use with another

Question 12

Will hardcoded data be revealed when software reverse engineering?

Answer 12

Yes, hardcoded data will be revealed

Question 13

Embedded environment variables

Answer 13

To use forms in flask we need to use a secret key - this secret key is used for securely signing the session cookie