Thick Client Penetration Testing

Thick client penetration testing assesses desktop applications that run on users’ machines and talk to back-end servers, such as trading platforms, banking terminals, ERP clients and internal business tools. Because so much logic and data lives on the client, these applications carry risks that web testing alone does not cover.

What We Test

• Local data storage: credentials, keys and sensitive data in files, registry and memory.
• Binary analysis: reverse engineering, hardcoded secrets and missing protections.
• DLL hijacking and insecure file permissions that allow privilege escalation.
• Network traffic: interception and tampering of client-server communication.
• Server-side and API flaws reachable through the client, including authorisation bypass.
• Database connections: direct database access and SQL injection from the client.

Our Approach

We combine static analysis of the application binaries with dynamic testing while the application runs. Traffic is proxied and modified to test the server, and the client is examined for secrets and weaknesses an attacker with local access could abuse. Two-tier and three-tier architectures built on Windows, .NET, Java, Electron and similar frameworks are supported.

What You Get

• Executive summary and detailed technical findings.
• Evidence, impact and remediation guidance for each issue.
• Recommendations for both client-side hardening and server-side fixes.
• A free retest after remediation.

Why Offensium Vault

• Specialist reverse engineering and client-side skills.
• Manual testing of both the client and its back end.
• ISO 27001 and ISO 9001 certified delivery.

Learn more in our article on thick client penetration testing and its security risks, or combine it with API security testing.

Frequently Asked Questions

What is a thick client application?

A thick client is a desktop application that performs significant processing locally and communicates with a server or database, unlike a browser-based thin client.

Do you need source code?

No. We can test as a black box using the installed application. Source code access, if available, lets us go deeper in less time.

Can you test applications that use proprietary protocols?

Yes. We analyse and intercept custom protocols as part of the assessment wherever technically feasible.

Get a Quote

Tell us about your environment and timelines and we will send a clear, fixed-scope proposal. Contact Offensium Vault or book a free call with our team.