Secure Code Review
Manual review of your most critical code, with findings mapped to exact lines and fixes your developers can apply.
Application testing
Thick Client Penetration Testing
We take your desktop application apart the way an attacker would and show you what it gives away on the machines it runs on.
- OWASP Desktop App Security Top 10
- OWASP WSTG (backend services)
Overview
Desktop software is still everywhere: trading terminals, healthcare systems, engineering tools, admin consoles, internal line-of-business apps. It is also one of the least tested parts of the attack surface. Once installed, a thick client runs on a machine the user controls. Every secret it holds and every check it makes can be inspected, patched or bypassed.
Few boutiques test desktop software in depth. We do. Our testers analyse the binary, the local environment and the server-side components together, so we find the issues that only show up when you look at all three.
Scope
What we test
- Traffic interception and protocol analysis
- Local storage of credentials, keys and sensitive data
- Hardcoded secrets and connection strings
- DLL and library hijacking
- Update and installer security
- Local privilege escalation through services and file permissions
- Binary analysis and decompilation (.NET, Java, Electron, C/C++)
- Licensing and feature-gating bypass
- Client-side security controls that can be bypassed
- Backend APIs and direct database connections
- Inter-process communication and named pipes
- Electron-specific risks such as Node integration and preload scripts
Findings
Common issues we find
Generic examples of what this kind of testing tends to uncover. Every engagement is different, and we never share client findings.
Critical
Database credentials inside the client
The app connects straight to a database with an account that every user can extract.
High
Updates that can be hijacked
Updates fetched over insecure channels or installed without verifying a signature.
High
Security checks enforced only in the client
Role, licence or approval checks that disappear when the client is patched or its traffic is replayed.
High
Privilege escalation through a helper service
A service running as SYSTEM or root that loads files or libraries from user-writable paths.
Medium
Secrets stored in plain text on disk
Tokens, passwords or keys left in config files, the registry or local caches.
High
Electron apps with dangerous settings
Node integration enabled or context isolation disabled, which turns a simple XSS into code execution.
Severity shown is typical, not fixed. We rate each finding on its real impact in your environment.
Approach
How we test it
Understand the architecture
We map how the client is installed, what it runs as, what it stores and which servers, protocols and databases it talks to.
Take the binary apart
We decompile or disassemble the application to find secrets, hidden features and client-side checks that an attacker could remove.
Attack the local environment
We test file and registry permissions, library loading, services, IPC and the update mechanism for ways to escalate privileges or run code.
Test the server side
We intercept and replay the client's traffic to test the backend for authorization, injection and logic flaws, without the client in the way.
Prove and prioritise
Every finding is reproduced with clear evidence and rated by impact, with fixes your developers can apply in the client, the server or both.
Deliverables
What you receive
Every finding comes with proof-of-concept evidence, so your engineers can reproduce it and your auditors can trust it.
Executive summary
A plain-English view of risk for leadership, boards and customers.
Technical findings
Each issue with impact, evidence, reproduction steps and a clear fix.
Free retest
Once you’ve fixed the findings, we retest them and update the report.
Attestation letter
A letter you can share with customers and auditors to show testing was done.
Preparation
What we need from you
We'll confirm the details during scoping. Having these ready helps testing start on time.
- Installers or builds for each platform in scope
- Test accounts for each user role and licence tier
- Details of the backend servers and any required VPN access
- A test machine or virtual machine image, if the setup is complex
- A technical contact for questions during testing
- An agreed testing window
FAQ
Thick Client testing questions
Which technologies do you test?
Windows, macOS and Linux applications built with .NET, Java, Electron and native C or C++. If your stack is unusual, tell us during scoping and we will confirm how we approach it.
Do you need the source code?
No. We test the compiled application as an attacker would. Source code helps us go deeper in less time, so we can combine the test with a secure code review if you prefer.
Does a thick client test include the server?
Yes. The servers and APIs the client talks to are part of the attack surface, and testing them is usually where the most serious findings come from.
Can you test a licensing or copy-protection scheme?
Yes. We assess how licensing and feature gating can be bypassed and how much effort that takes, so you can decide what level of protection is worth it.
Is a retest included?
Yes. Once you release fixes, we retest the reported issues at no extra cost and update the report with their status.
Related services
API Penetration Testing
Hands-on testing of REST, GraphQL and gRPC APIs for broken authorization, data exposure and abuse of business logic.
Internal Network & Active Directory Testing
Assumed-breach testing of your internal network and Active Directory, delivered remotely, to show how far one compromised laptop could go.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.