Dictionary generation for identifying coded credentials

Abstract

Techniques are described for identifying security credentials or other sensitive information by creating a dictionary of data elements included in documents such as source code files, object code files, or other types of files. The data elements may be identified for inclusion in the dictionary based on parsing the documents for delimiter characters, and based on the context of the data elements within the documents. The data elements may also be identified through an entropy-based analysis to detect portions of the documents exhibiting a high degree of entropy compared to a baseline entropy for the documents. The dictionary may be used in a dictionary attack against various systems to determine whether any of the data elements included in the dictionary enable access the systems. The data elements that enable access may be designated as sensitive information hard-coded into the documents.