Thick Client Application Pentesting

Testing thick client applications for security vulnerabilities requires expert manual penetration testing skills and a thoughtful, methodical approach. NetSPI’s thick client app penetration testing uses multi-vector cybersecurity testing to identify design and configuration weaknesses.

Schedule a Test

Thick Client Application Security Testing

Thick client applications are important for internal operations. They are often deployed to interact with sensitive data such as health records and financial information and can prove to be a large area of risk for an organization — especially if they are legacy applications. NetSPI identifies vulnerabilities in thick applications that make your organization susceptible to an external or internal security threat.

What Does NetSPI Test For?

We focus on the following areas during testing to ensure comprehensive coverage.

“”

Multi-vector Thick Client Expertise

” ”

Static Analysis

Service account roles and permissions (client, application server, database server)
Application file, folder, and registry permissions
Application service, provider, WMI subscription, task, and other permissions
Assembly compilation security flags
Protection of data in transit
Hardcoded sensitive data and authentication tokens (e.g. passwords, private keys)
Hardcoded encryption material (e.g. keys, IVs)
Use of insecure encryption and hashing algorithms
Database user roles and permissions
Database and server configurations

Dynamic Analysis

Authentication and authorization controls enforced on the client and server
Application user roles, permissions, and workflow logic between GUI elements
File system changes including file and folder creation, deletion, and modification
Registry changes of keys and values ( creation, deletion, modification)
Application objects and information stored in memory during runtime
Use of insecure encryption and hashing algorithms
Network protocols utilized by the application (e.g. SMB, FTP, TFTP)
Web services utilized by the application

NetSPI Thick Client Application Security Testing Methodology

NetSPI tests your thick client application whether it is hosted internally or in a virtualized environment. Our approach to thick client application security assessments includes reviewing server-side and client-side security controls, data communication paths, data storage, and authorization/authentication best practices. We employ manual and automated pentesting processes using commercial, open source, and proprietary cybersecurity testing tools to evaluate your application.

“”