preloader

How do attackers leverage the constants (string, URL, integers etc.) within a source code to deploy an attack?