Thick Client Penetration Testing

Thick client pentesting is the testing of desktop and rich applications (for example Windows, Java, or .NET apps) to find security problems. It is not only about the server. We also look at how the app stores data on the machine, how it talks to the server, and whether someone could tamper with it or reverse engineer it.

Stay updated with the official OWASP guide: https://owasp.org/www-project-desktop-app-security-top-10/

---

Table of Contents

1. What Is a Thick Client
2. Thin Client vs Thick Client
3. Two-Tier vs Three-Tier Applications
4. Common Programming Languages
5. Common Obfuscation and Deobfuscation
6. Common Vulnerabilities
7. Common Tools
8. Testing Methodology
9. Vulnerability Checklist
10. Deep Dive Guides
11. Resources
12. Checklists and GitHub References
13. Vulnerable Practice Applications
14. Credits

---

What Is a Thick Client

A thick client is an application that is installed locally on a user's desktop or laptop. These apps are full-featured and can often run on their own without a constant internet connection, unlike web apps that need the browser and server at all times.

Examples of thick clients:

1. Games such as Call of Duty and Uncharted
2. Web browsers
3. Music players
4. Video and chat tools such as Teams, Zoom, and Slack

Because a large part of the app runs on hardware the user controls, the local attack surface is larger than a typical web app. You can inspect the binary, read local storage, watch memory, and change runtime behavior.

---

Thin Client vs Thick Client

S.N	Basis	Thin Client	Thick Client
1	Basic	A lightweight client that relies on the host or server for most resources	Relies less on the server and provides rich local functionality
2	Data store	Data is stored on the server	Data is stored locally
3	Network	Needs a fast and stable network connection	Can work with a slow connection
4	Offline use	No offline use	Offline use is possible
5	Deployment	Easier to deploy and update	Deployment and updates are harder
6	Data validation	Validation is done on the server	Validation is often done on the client
7	Local resources	Uses fewer local resources	Uses more local resources
8	Attack surface	Smaller local attack surface	Larger local attack surface (client logic, local storage, memory)

---

Two-Tier vs Three-Tier Applications

Two-Tier Applications	Three-Tier Applications
The client and the server or database are on the same machine or the same internal network. Traffic goes from the client to the server directly, without an intermediary such as an application server.	The client connects over a network, and the business logic is handled by an application server. The client runs on the user's desktop, while the application server and database may be elsewhere. Communication usually uses HTTP/S, and sometimes other protocols such as FTP/S, TCP, or UDP.

---

Common Programming Languages

S.N	Language
1	.NET (WPF, WinForms)
2	Java (Swing, JavaFX)
3	C / C++
4	Electron (JavaScript / TypeScript)
5	Python (PyQt, Tkinter)
6	Delphi / Object Pascal

Knowing the language matters because it decides how you read the code. Managed languages like .NET and Java decompile back to near-original source, which makes them easy to inspect but also a common target for obfuscation. Native languages like C and C++ compile to machine code, so you disassemble rather than decompile.

Note: Microsoft Silverlight is end-of-life (since October 2021) and is only relevant for legacy targets.

---

Common Obfuscation and Deobfuscation

Developers use obfuscation to make reverse engineering harder. It does not add real security by itself, but it slows analysis. The type of obfuscation depends on the language. Below are the common obfuscators you will meet and the tools to undo or work around them.

.NET

.NET assemblies decompile cleanly, so .NET apps are the most heavily obfuscated. Common signs are renamed symbols (a, b, c or unicode names), control flow flattening, string encryption, and anti-tamper or anti-debug checks.

Obfuscator	Common signs
ConfuserEx / Confuser	Renamed symbols, control flow flattening, anti-tamper, packed resources
Dotfuscator	Renaming, string encryption, control flow
.NET Reactor	Native packing, string encryption, anti-debug
Babel, Eazfuscator, SmartAssembly	Renaming, string and resource encryption

Deobfuscation and analysis tools:

Tool	Use
de4dot	Automatic deobfuscation for many .NET obfuscators
dnSpyEx	Decompile, debug at runtime, and edit assemblies
ILSpy / dotPeek	Decompile to C#
ConfuserEx unpackers (specialized scripts)	Undo specific ConfuserEx protections
dnlib	Script custom deobfuscation of .NET metadata

Practical tip: even when static deobfuscation fails, you can run the app under dnSpyEx or Frida and read decrypted strings and keys at runtime, since the app must deobfuscate itself to run.

Java

Java bytecode also decompiles well, so JAR files are often obfuscated with renaming and string encryption.

Obfuscator	Common signs
ProGuard	Short renamed classes and methods
Allatori, Zelix KlassMaster, DashO	String encryption, control flow, flow obfuscation

Deobfuscation and analysis tools:

Tool	Use
JADX	Decompile JAR and class files to Java
JD-GUI	Quick Java decompiler
CFR, Procyon, Fernflower	Alternative decompilers that handle tricky bytecode
Java Deobfuscator	Automatic deobfuscation framework
Bytecode Viewer	Combines several decompilers and a bytecode editor

Native (C and C++)

Native binaries do not decompile to source, so obfuscation here means packing, anti-analysis, and control flow tricks. First identify the packer, then unpack before real analysis.

Protection	Common signs
UPX	High-entropy sections, few imports; unpack with upx -d
Themida, VMProtect, Enigma	Virtualized code, anti-debug, anti-VM
Custom packers	High entropy, tiny import table, self-modifying code

Analysis tools:

Tool	Use
Detect It Easy (DIE)	Identify the packer and protections
x64dbg with Scylla	Unpack at runtime and rebuild the import table
Ghidra / IDA Pro	Disassemble and decompile the unpacked binary
PE-bear	Inspect and repair PE headers after unpacking

Electron and JavaScript

Electron apps ship their JavaScript inside an ASAR archive. It is often minified rather than truly obfuscated.

Tool	Use
asar	Extract app.asar to read the source (npx asar extract app.asar out)
js-beautify	Reformat minified JavaScript
de4js	Deobfuscate common JavaScript obfuscators
Browser or Electron DevTools	Debug and read values at runtime

Python

Python thick clients are often packaged with PyInstaller or py2exe. You can usually recover the bytecode and then the source.

Tool	Use
pyinstxtractor	Extract PyInstaller executables back to .pyc files
uncompyle6 / decompyle3	Decompile .pyc to Python source
pycdc	Alternative bytecode decompiler

Reminder: obfuscation is not a control that protects secrets. If the app can run it, you can recover it, most reliably at runtime. Treat any secret or key found in obfuscated code as exposed.

---

Common Vulnerabilities

S.N	Vulnerability
1	Hardcoded secrets in the source code
2	Insecure communication (weak or missing TLS)
3	Buffer overflow
4	DLL hijacking
5	Debug mode left enabled
6	SQL injection
7	Improper exception handling
8	Command injection
9	Information disclosure through stack trace errors
10	Insecure Direct Object References (IDOR)
11	Security misconfiguration
12	Unvalidated redirects and forwards
13	Broken authentication
14	Insecure deserialization
15	Missing function-level access control
16	Remote Code Execution (RCE)
17	Sensitive data or logs stored in cleartext
18	Secrets left unencrypted in memory
19	Missing binary protections (ASLR, DEP, CFG)
20	Weak or missing anti-tamper and anti-debug controls

---

Common Tools

S.N	Tool	Category	Primary Use
1	Burp Suite	Traffic Interception	Proxy HTTP/S traffic; use the NoPE extension for non-HTTP thick clients
2	Fiddler	Traffic Interception	Capture and modify HTTP/S traffic
3	Echo Mirage	Traffic Interception	Inject into the process and intercept raw TCP or socket traffic, no certificate needed
4	MITM Relay	Traffic Interception	Relay non-HTTP TCP or TLS traffic through an HTTP proxy such as Burp
5	Mallory	Traffic Interception	Linux-based capture of TCP and UDP traffic
6	Wireshark	Packet Analysis	Inspect raw packets and find cleartext data on the wire
7	Nmap	Network Scanning	Port and service enumeration of the backend
8	testssl.sh	SSL/TLS Testing	Detect weak TLS versions, ciphers, and certificate issues
9	Procmon	Process Monitoring	File, registry, and process activity; find DLL hijacking and insecure file access
10	Process Explorer	Process Monitoring	Handles, loaded DLLs, and the process tree
11	Process Hacker / System Informer	Process and Memory	Live memory browsing, strings, handles, and memory dumps
12	Sysinternals Suite	System Analysis	Bundle: Procmon, Process Explorer, TCPView, Sigcheck, Strings, AccessChk, and more
13	TCPView	Network Monitoring	Live view of the app's TCP and UDP connections
14	CFF Explorer	PE / Static Analysis	Inspect PE headers, imports, .NET metadata, and resources
15	Detect It Easy (DIE)	Static Analysis	Identify language, packer, compiler, and protections
16	Strings	Static Analysis	Pull readable strings from binaries; find secrets and endpoints
17	dnSpyEx	.NET Decompile / Debug	Decompile, edit, and debug .NET assemblies (maintained fork of dnSpy)
18	dotPeek	.NET Decompile	Decompile .NET assemblies to C#
19	ILSpy	.NET Decompile	Open-source .NET decompiler
20	de4dot	.NET Deobfuscation	Deobfuscate protected .NET assemblies
21	JADX / JD-GUI	Java Decompile	Decompile Java or JAR thick clients
22	JavaSnoop	Java Instrumentation	Attach to a running JVM and intercept methods
23	WinDbg	Debugging / Memory	Deep live debugging and dump analysis; search memory, inspect heap and stack
24	x64dbg / x32dbg	Debugging	Modern user-mode debugger for reversing and patching (OllyDbg replacement)
25	Ghidra	Binary RE	Free disassembler and decompiler for native binaries
26	IDA Pro / IDA Free	Binary RE	Industry-standard disassembler and decompiler
27	Radare2 / Cutter	Binary RE	Open-source disassembly and analysis framework
28	Frida	Dynamic Instrumentation	Hook functions, tamper at runtime, scan memory, bypass client-side checks
29	API Monitor	API Tracing	Watch Windows API calls (crypto, file, registry, network)
30	HxD	Hex Editor	View and edit binaries and memory dumps
31	Regshot	Registry Analysis	Diff the registry before and after running the app
32	DB Browser for SQLite	Local Storage	Read local SQLite databases the app stores
33	PESecurity / winchecksec	Binary Protections	Check ASLR, DEP, SafeSEH, CFG, and signing on the binary
34	Sigcheck	Integrity	Verify digital signatures and file metadata
35	VisualCodeGrepper (VCG)	SAST	Automated source-code security scanning
36	GUI inspection tools	GUI Testing	Spy++, WinSpy++, Window Detective, and Snoop WPF for GUI object tampering

---

Testing Methodology

Testing usually moves through these phases:

1. Information gathering: architecture, language, endpoints, and entry points.
2. GUI testing: hidden or disabled controls, masked fields, and client-side logic.
3. File system testing: permissions, config secrets, and local storage.
4. Registry testing: permissions, stored secrets, and manipulation.
5. Network and traffic testing: interception, TLS strength, and tampering.
6. Binary and assembly protection testing: ASLR, DEP, CFG, and signing.
7. Memory testing: secrets in memory, dumps, and runtime manipulation.
8. Reverse engineering: decompile, deobfuscate, patch, and rebuild.
9. Common vulnerability testing: injection, deserialization, and logic flaws.

Vulnerability Checklist

The full, checkable list lives in a separate file so you can track progress as you test:

• Thick Client Penetration Testing Checklist

It covers all twenty-two areas (information gathering, GUI, file system, registry, network, binary protections, memory, reverse engineering, auth, data storage, injection, DLL and process security, cryptography, logging, software updates, IPC, privilege escalation and persistence, protocol handlers and argument injection, framework-specific tests, local and embedded servers, licensing and business logic, and reporting) with clickable checkboxes.

---

Deep Dive Guides

Longer, beginner-friendly guides in this repo that go deeper on specific topics:

• Memory Analysis with WinDbg: how memory works (stack, heap, registers), and how to search a running app or a dump for secrets, step by step.
• Process Injection: the Windows basics behind injection and a walkthrough of each technique, with detection notes for defenders.

---

Resources

S.N	Credit	Resource
1	CyberArk	Thick Client Penetration Testing Methodology
2	DarkRelay	Thick Client Penetration Testing
3	Payatu	Thick Client Penetration Testing
4	QualySec	Thick Client Pen Testing: A Comprehensive Guide
5	Medium (Abhishek)	Thick Client Security Testing: The Essential Guide
6	Infosec Writeups	Thick Client Pentest: Modern Approaches and Techniques (Part 1)
7	Threat Intelligence	Thick Client Application Penetration Test
8	Optiv	Thick Client Application Security Testing

---

Checklists and GitHub References

S.N	Credit	Resource
1	Hari-prasaanth	Thick Client Pentest Checklist
2	m14r41	PentestingEverything Repository
3	RaKKeN	Thick Client Penetration Testing

---

Vulnerable Practice Applications

S.N	Credit	Application
1	srini0x00	DVTA (Damn Vulnerable Thick Client App)
2	kartikdurg	Terrible Thick Client
3	Warxim	VUCSA
4	DarkRelayLabs	VWA
5	NetSPI	BetaFast

---

Credits

S.N	Credit
1	Viraj Mota
2	Optiv - Source Zero