Performing Thick Client Application Penetration Test Overview Thick client (fat client) penetration testing assesses the security of desktop applications that run locally on user machines and communicate with backend servers. Unlike web applications, thick clients present a broader attack surface including local file storage, binary analysis, memory manipulation, DLL injection, process interception, and client-server communication. Common targets include banking applications, ERP clients (SAP GUI), trading platforms, healthcare systems, and legacy enterprise software. When to Use - When condu…

)\n\n\nclass ThickClientPentestAgent:\n \"\"\"Performs security assessment of thick/fat client applications.\"\"\"\n\n def __init__(self, app_path, output_dir=\"./thick_client_pentest\"):\n self.app_path = Path(app_path)\n self.output_dir = Path(output_dir)\n self.output_dir.mkdir(parents=True, exist_ok=True)\n self.findings = []\n\n def extract_strings(self, min_length=6):\n \"\"\"Extract readable strings from binary for credential/URL discovery.\"\"\"\n patterns = {\n \"url\": re.compile(r'https?://[^\\s\"\\'\u003c>]{5,200}'),\n \"email\": re.compile(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}'),\n \"ip_addr\": re.compile(r'\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b'),\n \"password_hint\": re.compile(\n r'(?i)(password|passwd|pwd|secret|api.?key|token|'\n r'connectionstring|jdbc|bearer)', re.IGNORECASE),\n \"sql_query\": re.compile(r'(?i)(SELECT|INSERT|UPDATE|DELETE)\\s+', re.IGNORECASE),\n }\n results = {k: [] for k in patterns}\n try:\n with open(self.app_path, \"rb\") as f:\n data = f.read()\n text = data.decode(\"ascii\", errors=\"ignore\")\n for name, pattern in patterns.items():\n matches = pattern.findall(text)\n results[name] = list(set(matches))[:50]\n\n if results[\"password_hint\"]:\n self.findings.append({\n \"type\": \"Credential Reference in Binary\",\n \"severity\": \"Medium\",\n \"details\": f\"Found {len(results['password_hint'])} credential-related strings\",\n })\n if results[\"sql_query\"]:\n self.findings.append({\n \"type\": \"SQL Queries in Binary\",\n \"severity\": \"Medium\",\n \"details\": \"Embedded SQL may be vulnerable to injection\",\n })\n except (OSError, PermissionError) as exc:\n results[\"error\"] = str(exc)\n return results\n\n def detect_framework(self):\n \"\"\"Detect the application framework (.NET, Java, Electron, C++).\"\"\"\n try:\n with open(self.app_path, \"rb\") as f:\n header = f.read(4096)\n\n if b\"BSJB\" in header or b\".NET\" in header or b\"mscorlib\" in header:\n return {\"framework\": \".NET\", \"decompiler\": \"dnSpy / ILSpy\"}\n if b\"PK\" in header[:4]:\n return {\"framework\": \"Java (JAR)\", \"decompiler\": \"JD-GUI / JADX\"}\n if b\"asar\" in header or b\"electron\" in header:\n return {\"framework\": \"Electron\", \"tool\": \"asar extract\"}\n return {\"framework\": \"Native (C/C++)\", \"decompiler\": \"Ghidra / IDA Pro\"}\n except OSError as exc:\n return {\"error\": str(exc)}\n\n def check_local_storage(self, app_name=None):\n \"\"\"Scan common local storage locations for sensitive data.\"\"\"\n app_name = app_name or self.app_path.stem\n locations = []\n appdata = os.environ.get(\"APPDATA\", \"\")\n localappdata = os.environ.get(\"LOCALAPPDATA\", \"\")\n\n search_dirs = [\n Path(appdata) / app_name if appdata else None,\n Path(localappdata) / app_name if localappdata else None,\n self.app_path.parent,\n ]\n sensitive_exts = {\".db\", \".sqlite\", \".sqlite3\", \".json\", \".xml\",\n \".config\", \".ini\", \".cfg\", \".log\"}\n\n for search_dir in search_dirs:\n if search_dir is None or not search_dir.exists():\n continue\n for root, dirs, files in os.walk(search_dir):\n for fname in files:\n fpath = Path(root) / fname\n if fpath.suffix.lower() in sensitive_exts:\n size = fpath.stat().st_size\n locations.append({\n \"path\": str(fpath), \"type\": fpath.suffix,\n \"size_bytes\": size,\n })\n\n if locations:\n self.findings.append({\n \"type\": \"Sensitive Local Files\",\n \"severity\": \"Medium\",\n \"details\": f\"Found {len(locations)} potentially sensitive files\",\n })\n return locations\n\n def audit_sqlite_databases(self, db_paths):\n \"\"\"Check local SQLite databases for plaintext credentials.\"\"\"\n results = []\n for db_path in db_paths:\n try:\n conn = sqlite3.connect(f\"file:{db_path}?mode=ro\", uri=True)\n cursor = conn.cursor()\n cursor.execute(\"SELECT name FROM sqlite_master WHERE type='table'\")\n tables = [r[0] for r in cursor.fetchall()]\n\n sensitive_tables = []\n for table in tables:\n lower = table.lower()\n if any(kw in lower for kw in\n [\"user\", \"account\", \"credential\", \"auth\",\n \"login\", \"password\", \"token\", \"session\"]):\n if not _SAFE_TABLE_RE.match(table):\n continue\n cursor.execute(f\"SELECT COUNT(*) FROM [{table}]\")\n count = cursor.fetchone()[0]\n sensitive_tables.append({\"table\": table, \"rows\": count})\n\n if sensitive_tables:\n self.findings.append({\n \"type\": \"Sensitive SQLite Database\",\n \"severity\": \"High\",\n \"details\": f\"{db_path}: {sensitive_tables}\",\n })\n results.append({\"database\": db_path, \"tables\": tables,\n \"sensitive_tables\": sensitive_tables})\n conn.close()\n except sqlite3.Error as exc:\n results.append({\"database\": db_path, \"error\": str(exc)})\n return results\n\n def check_dll_hijack_paths(self):\n \"\"\"Check for DLL hijacking via writable directories in PATH.\"\"\"\n writable_dirs = []\n path_dirs = os.environ.get(\"PATH\", \"\").split(os.pathsep)\n for d in path_dirs:\n if os.path.isdir(d) and os.access(d, os.W_OK):\n writable_dirs.append(d)\n\n app_dir = str(self.app_path.parent)\n app_dir_writable = os.access(app_dir, os.W_OK)\n\n if writable_dirs or app_dir_writable:\n self.findings.append({\n \"type\": \"DLL Hijacking Risk\",\n \"severity\": \"High\",\n \"details\": f\"Writable PATH dirs: {len(writable_dirs)}, \"\n f\"App dir writable: {app_dir_writable}\",\n })\n return {\"writable_path_dirs\": writable_dirs,\n \"app_dir_writable\": app_dir_writable}\n\n def generate_report(self):\n \"\"\"Generate comprehensive pentest findings report.\"\"\"\n report = {\n \"target\": str(self.app_path),\n \"report_date\": datetime.utcnow().isoformat(),\n \"framework\": self.detect_framework(),\n \"total_findings\": len(self.findings),\n \"critical\": sum(1 for f in self.findings if f[\"severity\"] == \"Critical\"),\n \"high\": sum(1 for f in self.findings if f[\"severity\"] == \"High\"),\n \"medium\": sum(1 for f in self.findings if f[\"severity\"] == \"Medium\"),\n \"findings\": self.findings,\n }\n report_path = self.output_dir / \"thick_client_report.json\"\n with open(report_path, \"w\") as f:\n json.dump(report, f, indent=2)\n print(json.dumps(report, indent=2))\n return report\n\n\ndef main():\n if len(sys.argv) \u003c 2:\n print(\"Usage: agent.py \u003capplication.exe> [output_dir]\")\n sys.exit(1)\n app_path = sys.argv[1]\n output_dir = sys.argv[2] if len(sys.argv) > 2 else \"./thick_client_pentest\"\n agent = ThickClientPentestAgent(app_path, output_dir)\n agent.extract_strings()\n agent.check_local_storage()\n agent.check_dll_hijack_paths()\n agent.generate_report()\n\n\nif __name__ == \"__main__\":\n main()\n","content_type":"text/x-python; charset=utf-8","language":"python","size":8730,"content_sha256":"181282c9800e93d79836a538a9c17f8896980e32521884b0f2d7908f2a495107"},{"filename":"scripts/process.py","content":"#!/usr/bin/env python3\n\"\"\"\nThick Client Penetration Test — Static Analysis Helper\n\nPerforms basic static analysis on thick client applications: string extraction,\nconfig file scanning, and DLL dependency analysis.\n\nUsage:\n python process.py --app-dir \"C:/Program Files/TargetApp\" --output ./results\n\"\"\"\n\nimport os\nimport re\nimport json\nimport argparse\nimport datetime\nfrom pathlib import Path\n\n\nSENSITIVE_PATTERNS = {\n \"password\": re.compile(r'(?i)(password|passwd|pwd)\\s*[=:]\\s*[\"\\']?([^\\s\"\\']+)'),\n \"api_key\": re.compile(r'(?i)(api[_-]?key|apikey)\\s*[=:]\\s*[\"\\']?([^\\s\"\\']+)'),\n \"connection_string\": re.compile(r'(?i)(connection[_-]?string|jdbc:)\\s*[=:]\\s*[\"\\']?([^\\s\"\\']+)'),\n \"secret\": re.compile(r'(?i)(secret|token)\\s*[=:]\\s*[\"\\']?([^\\s\"\\']+)'),\n \"url_with_creds\": re.compile(r'https?://[^:]+:[^@]+@[\\w.]+'),\n \"hardcoded_ip\": re.compile(r'\\b(?:10|172\\.(?:1[6-9]|2\\d|3[01])|192\\.168)\\.\\d{1,3}\\.\\d{1,3}\\b'),\n}\n\n\ndef extract_strings(filepath: str, min_length: int = 8) -> list[str]:\n \"\"\"Extract printable strings from a binary file.\"\"\"\n strings = []\n try:\n with open(filepath, \"rb\") as f:\n data = f.read()\n\n current = []\n for byte in data:\n if 32 \u003c= byte \u003c= 126:\n current.append(chr(byte))\n else:\n if len(current) >= min_length:\n strings.append(\"\".join(current))\n current = []\n if len(current) >= min_length:\n strings.append(\"\".join(current))\n except (PermissionError, OSError):\n pass\n return strings\n\n\ndef scan_for_secrets(strings: list[str]) -> list[dict]:\n \"\"\"Scan extracted strings for sensitive patterns.\"\"\"\n findings = []\n for s in strings:\n for name, pattern in SENSITIVE_PATTERNS.items():\n match = pattern.search(s)\n if match:\n findings.append({\n \"type\": name,\n \"match\": s[:200],\n \"severity\": \"High\" if name in (\"password\", \"connection_string\", \"secret\") else \"Medium\"\n })\n break\n return findings\n\n\ndef scan_config_files(app_dir: str) -> list[dict]:\n \"\"\"Scan configuration files for sensitive data.\"\"\"\n config_extensions = {\".config\", \".xml\", \".json\", \".ini\", \".properties\", \".yaml\", \".yml\", \".cfg\"}\n findings = []\n\n for root, dirs, files in os.walk(app_dir):\n for filename in files:\n ext = os.path.splitext(filename)[1].lower()\n if ext in config_extensions:\n filepath = os.path.join(root, filename)\n try:\n with open(filepath, encoding=\"utf-8\", errors=\"ignore\") as f:\n content = f.read()\n for name, pattern in SENSITIVE_PATTERNS.items():\n matches = pattern.findall(content)\n for match in matches:\n findings.append({\n \"file\": filepath,\n \"type\": name,\n \"match\": str(match)[:200],\n \"severity\": \"High\"\n })\n except (PermissionError, OSError):\n continue\n return findings\n\n\ndef analyze_dlls(app_dir: str) -> list[dict]:\n \"\"\"Analyze DLL dependencies for potential hijacking.\"\"\"\n dlls = []\n for root, dirs, files in os.walk(app_dir):\n for filename in files:\n if filename.lower().endswith(\".dll\"):\n filepath = os.path.join(root, filename)\n dlls.append({\n \"name\": filename,\n \"path\": filepath,\n \"writable\": os.access(filepath, os.W_OK),\n \"size\": os.path.getsize(filepath)\n })\n\n writable = [d for d in dlls if d[\"writable\"]]\n return dlls, writable\n\n\ndef generate_report(app_dir: str, string_findings: list[dict],\n config_findings: list[dict], dll_info: tuple,\n output_dir: Path) -> str:\n \"\"\"Generate thick client analysis report.\"\"\"\n report_file = output_dir / \"thick_client_report.md\"\n timestamp = datetime.datetime.now(datetime.timezone.utc).strftime(\"%Y-%m-%d %H:%M UTC\")\n all_dlls, writable_dlls = dll_info\n\n with open(report_file, \"w\") as f:\n f.write(\"# Thick Client Static Analysis Report\\n\\n\")\n f.write(f\"**Application:** {app_dir}\\n\")\n f.write(f\"**Generated:** {timestamp}\\n\\n---\\n\\n\")\n\n f.write(\"## Binary String Analysis\\n\\n\")\n if string_findings:\n f.write(f\"Found **{len(string_findings)}** potentially sensitive strings:\\n\\n\")\n f.write(\"| Type | Match | Severity |\\n|------|-------|----------|\\n\")\n for finding in string_findings[:50]:\n f.write(f\"| {finding['type']} | `{finding['match'][:80]}` | {finding['severity']} |\\n\")\n else:\n f.write(\"No sensitive strings detected in binaries.\\n\")\n f.write(\"\\n\")\n\n f.write(\"## Configuration File Analysis\\n\\n\")\n if config_findings:\n f.write(f\"Found **{len(config_findings)}** sensitive entries in configs:\\n\\n\")\n for finding in config_findings[:20]:\n f.write(f\"- **{finding['type']}** in `{finding['file']}`: `{finding['match'][:80]}`\\n\")\n else:\n f.write(\"No sensitive data found in configuration files.\\n\")\n f.write(\"\\n\")\n\n f.write(\"## DLL Analysis\\n\\n\")\n f.write(f\"Total DLLs: **{len(all_dlls)}**\\n\")\n f.write(f\"Writable DLLs (potential hijacking): **{len(writable_dlls)}**\\n\\n\")\n if writable_dlls:\n f.write(\"| DLL | Path |\\n|-----|------|\\n\")\n for dll in writable_dlls:\n f.write(f\"| {dll['name']} | {dll['path']} |\\n\")\n f.write(\"\\n\")\n\n print(f\"[+] Report: {report_file}\")\n return str(report_file)\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"Thick Client Static Analysis\")\n parser.add_argument(\"--app-dir\", required=True, help=\"Application installation directory\")\n parser.add_argument(\"--output\", default=\"./results\")\n args = parser.parse_args()\n\n output_dir = Path(args.output)\n output_dir.mkdir(parents=True, exist_ok=True)\n\n print(f\"[*] Scanning {args.app_dir}...\")\n\n # Scan binaries for strings\n all_findings = []\n for root, dirs, files in os.walk(args.app_dir):\n for filename in files:\n if filename.lower().endswith((\".exe\", \".dll\")):\n filepath = os.path.join(root, filename)\n strings = extract_strings(filepath)\n findings = scan_for_secrets(strings)\n all_findings.extend(findings)\n\n # Scan config files\n config_findings = scan_config_files(args.app_dir)\n\n # Analyze DLLs\n dll_info = analyze_dlls(args.app_dir)\n\n generate_report(args.app_dir, all_findings, config_findings, dll_info, output_dir)\n print(\"[+] Analysis complete\")\n\n\nif __name__ == \"__main__\":\n main()\n","content_type":"text/x-python; charset=utf-8","language":"python","size":7058,"content_sha256":"6d8a34329e41a597059a80cb4d66b9975b6fc576a7455cd1bf19ff3f2112e070"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Performing Thick Client Application Penetration Test","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Thick client (fat client) penetration testing assesses the security of desktop applications that run locally on user machines and communicate with backend servers. Unlike web applications, thick clients present a broader attack surface including local file storage, binary analysis, memory manipulation, DLL injection, process interception, and client-server communication. Common targets include banking applications, ERP clients (SAP GUI), trading platforms, healthcare systems, and legacy enterprise software.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"When conducting security assessments that involve performing thick client application penetration test","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"When following incident response procedures for related security events","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"When performing scheduled security testing or auditing activities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"When validating security controls through hands-on testing","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Application installer and valid credentials","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Windows/Linux test machine (isolated)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Tools: dnSpy, Procmon, Process Hacker, Wireshark, Burp Suite, Echo Mirage, Fiddler, IDA Pro/Ghidra","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Administrative access to test machine","type":"text"}]}]}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Legal Notice:","type":"text","marks":[{"type":"strong"}]},{"text":" This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Phase 1 — Information Gathering","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Static Analysis","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Identify application technology\n# Check file properties, signatures, framework (.NET, Java, C++, Electron)\nfile application.exe\n# .NET -> dnSpy, JetBrains dotPeek\n# Java -> JD-GUI, JADX\n# C/C++ -> Ghidra, IDA Pro\n# Electron -> extract asar archive\n\n# Check for .NET framework\nGet-ChildItem -Path \"C:\\Program Files\\TargetApp\" -Recurse -Filter \"*.dll\" |\n ForEach-Object { [System.Reflection.AssemblyName]::GetAssemblyName($_.FullName).FullName }\n\n# Strings analysis\nstrings application.exe | findstr -i \"password\\|secret\\|api\\|key\\|token\\|jdbc\\|connection\"\n\n# Check for hardcoded credentials\nstrings application.exe | findstr -i \"username\\|user=\\|pass=\\|pwd=\\|admin\"\n\n# Review configuration files\ntype \"C:\\Program Files\\TargetApp\\app.config\"\ntype \"C:\\Program Files\\TargetApp\\settings.xml\"\ntype \"%APPDATA%\\TargetApp\\config.json\"\n\n# Check for certificate pinning\nstrings application.exe | findstr -i \"cert\\|pin\\|ssl\\|tls\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":".NET Decompilation with dnSpy","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Open application in dnSpy\n1. Launch dnSpy\n2. File > Open > Select application.exe and DLLs\n3. Search for:\n - \"password\", \"secret\", \"connectionString\"\n - Authentication methods\n - Encryption/decryption functions\n - API endpoints and keys\n - License validation logic\n\n# Look for:\n- Hardcoded credentials in source\n- Insecure encryption (DES, MD5, base64 \"encryption\")\n- SQL queries (potential injection)\n- Disabled certificate validation\n- Debug/verbose logging with sensitive data","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Phase 2 — Dynamic Analysis","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Process Monitoring","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Monitor file system activity with Procmon\n# Filters:\n# Process Name = application.exe\n# Operation = CreateFile, WriteFile, ReadFile, RegSetValue\n\n# Key observations:\n# - Where does the app store data? (AppData, temp, registry)\n# - Does it write credentials to disk?\n# - Does it create temporary files with sensitive data?\n# - What registry keys does it access?\n\n# Monitor with Process Hacker\n# Check: loaded DLLs, network connections, handles, tokens\n\n# Monitor network traffic\n# Wireshark filter: ip.addr == \u003cserver_ip>\n# Check for: unencrypted credentials, API keys, tokens","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Traffic Interception","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Intercept HTTP/HTTPS traffic with Burp Suite\n# Configure system proxy: 127.0.0.1:8080\n# Install Burp CA certificate in Windows certificate store\n\n# For non-HTTP protocols, use Echo Mirage\n# Inject into process and intercept TCP/UDP traffic\n\n# For HTTPS with certificate pinning:\n# Method 1: Patch certificate validation in dnSpy\n# Method 2: Use Frida to hook SSL validation\nfrida -l bypass_ssl_pinning.js -f application.exe\n\n# Fiddler for .NET applications\n# Enable HTTPS decryption\n# Monitor API calls, request/response bodies","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Phase 3 — Vulnerability Testing","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Authentication Bypass","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# Test local authentication bypass\n1. Open dnSpy, find authentication method\n2. Set breakpoint on credential validation\n3. Modify return value to bypass (Debug > Set Next Statement)\n4. Or: Patch binary to always return true\n\n# Test for credential storage\n# Check: registry, config files, SQLite databases, Windows Credential Manager\nreg query \"HKCU\\Software\\TargetApp\" /s\ntype \"%APPDATA%\\TargetApp\\user.db\"\n# SQLite: sqlite3 user.db \".dump\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"DLL Hijacking","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Identify DLL search order vulnerability\n# Use Procmon to find DLLs loaded from writable paths\n# Filter: Result = NAME NOT FOUND, Path ends with .dll\n\n# Create malicious DLL\n# msfvenom -p windows/exec CMD=calc.exe -f dll -o hijacked.dll\n# Place in application directory or writable PATH directory\n\n# DLL sideloading\n# If app loads DLL without full path:\n# 1. Create DLL with same exports\n# 2. Place in app directory\n# 3. DLL loads before legitimate version","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Memory Analysis","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Dump process memory\n# Use Process Hacker > Process > Properties > Memory\n# Search for plaintext credentials, tokens, session IDs\n\n# Strings from memory dump\nstrings process_dump.dmp | findstr -i \"password\\|token\\|session\\|bearer\"\n\n# Modify memory values (license bypass, privilege escalation)\n# Use Cheat Engine or x64dbg to:\n# 1. Find memory address of authorization variable\n# 2. Modify value (e.g., isAdmin = 0 -> isAdmin = 1)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Input Validation","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"# SQL Injection in local database\n# Test input fields with: ' OR 1=1--\n# If app uses local SQLite/SQL Server Express\n\n# Command injection\n# Test fields that interact with OS:\n# File paths: ..\\..\\..\\..\\windows\\system32\\cmd.exe\n# Print/export: | calc.exe\n\n# Buffer overflow\n# Send oversized input to text fields\n# Monitor with x64dbg for crashes\n# Check for SEH-based or stack-based overflows","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Phase 4 — API Security Testing","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Capture API calls from thick client\n# In Burp Suite, analyze:\n\n# IDOR (Insecure Direct Object Reference)\n# Change user IDs in requests to access other users' data\n# GET /api/users/1001 -> GET /api/users/1002\n\n# Authorization bypass\n# Remove or modify JWT tokens\n# Test role escalation: change role claim from \"user\" to \"admin\"\n\n# Mass assignment\n# Add additional parameters to API requests\n# POST /api/profile {\"name\": \"test\", \"isAdmin\": true}\n\n# Rate limiting\n# Test for brute-force protection on login API\n# Test for account lockout bypass","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Findings Template","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Finding","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Severity","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CVSS","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Remediation","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Hardcoded database credentials in binary","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"9.1","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use secure credential storage (DPAPI, vault)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"DLL hijacking via writable app directory","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"7.8","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use full DLL paths, validate DLL signatures","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Plaintext credentials in memory","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"7.5","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Zero memory after use, use SecureString","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"No certificate pinning","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Medium","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"6.5","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Implement certificate pinning","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Local SQLite DB with cleartext passwords","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"9.0","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use bcrypt/Argon2 hashing","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Disabled SSL validation in code","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"8.1","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Enable proper certificate validation","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"dnSpy: https://github.com/dnSpy/dnSpy","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Procmon: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OWASP Thick Client Testing Guide: https://owasp.org/www-project-thick-client-top-10/","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ghidra: https://ghidra-sre.org/","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Echo Mirage: https://sourceforge.net/projects/echomirage/","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"performing-thick-client-application-penetration-test","tags":["thick-client","desktop-application","dnSpy","Procmon","DLL-hijacking","binary-analysis","API-interception"],"author":"@skillopedia","domain":"cybersecurity","source":{"stars":13207,"repo_name":"anthropic-cybersecurity-skills","origin_url":"https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-thick-client-application-penetration-test/SKILL.md","repo_owner":"mukul975","body_sha256":"68f4f4b2e3d8111ac9e4d73a52aea065ad12bd30e1786f029a0294463cfbf561","cluster_key":"17f6484742c1dd825ab5c0ddec98e694d67cfdc9e0105e3434ec514f20d04cd7","clean_bundle":{"format":"clean-skill-bundle-v1","source":"mukul975/anthropic-cybersecurity-skills/skills/performing-thick-client-application-penetration-test/SKILL.md","attachments":[{"id":"984fbdaf-8716-5435-a606-63aec93f951f","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/984fbdaf-8716-5435-a606-63aec93f951f/attachment.md","path":"assets/template.md","size":691,"sha256":"faaf03e906481bd5e4eba9723363b7ba7a744fd26e64f324f273cad8f6a0cc65","contentType":"text/markdown; charset=utf-8"},{"id":"c9f6d080-431a-5a3d-983c-14a051a57e8a","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/c9f6d080-431a-5a3d-983c-14a051a57e8a/attachment.md","path":"references/api-reference.md","size":2337,"sha256":"b2306884da5e0a752481df4b03c1cb73c8fb1043097e1471806c9482a855efb7","contentType":"text/markdown; charset=utf-8"},{"id":"0a9ae34e-dd38-501c-adfc-e569141313ad","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/0a9ae34e-dd38-501c-adfc-e569141313ad/attachment.md","path":"references/standards.md","size":544,"sha256":"52cb3f8e5b97ebb05d4542d151a291e4bef7538e60bfe5ed7fca819b8e0e3e8c","contentType":"text/markdown; charset=utf-8"},{"id":"13063f6e-0d6c-590d-a1b2-9dff0f889a7c","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/13063f6e-0d6c-590d-a1b2-9dff0f889a7c/attachment.md","path":"references/workflows.md","size":821,"sha256":"3e24d294c3fc5e399f5774bdec1af50487d16667e9aad374520f417dfd4927ef","contentType":"text/markdown; charset=utf-8"},{"id":"67e7715a-5a1d-5d00-8a55-5488a9cecc02","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/67e7715a-5a1d-5d00-8a55-5488a9cecc02/attachment.py","path":"scripts/agent.py","size":8730,"sha256":"181282c9800e93d79836a538a9c17f8896980e32521884b0f2d7908f2a495107","contentType":"text/x-python; charset=utf-8"},{"id":"3a00df32-c7cb-5834-9e40-49d39b641828","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/3a00df32-c7cb-5834-9e40-49d39b641828/attachment.py","path":"scripts/process.py","size":7058,"sha256":"6d8a34329e41a597059a80cb4d66b9975b6fc576a7455cd1bf19ff3f2112e070","contentType":"text/x-python; charset=utf-8"}],"bundle_sha256":"d3f03bfbf2ade9f1aa7e6690a9fffdb1577eda8276de157d1e262282ca4f7daa","attachment_count":6,"text_attachments":6,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":1,"skill_md_path":"skills/performing-thick-client-application-penetration-test/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"testing-qa","category_label":"Testing"},"exact_dupes_collapsed_into_this":0},"license":"Apache-2.0","version":"v1","category":"testing-qa","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"subdomain":"penetration-testing","import_tag":"clean-skills-v1","description":"Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite.","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"]}},"renderedAt":1782980887391}

Performing Thick Client Application Penetration Test Overview Thick client (fat client) penetration testing assesses the security of desktop applications that run locally on user machines and communicate with backend servers. Unlike web applications, thick clients present a broader attack surface including local file storage, binary analysis, memory manipulation, DLL injection, process interception, and client-server communication. Common targets include banking applications, ERP clients (SAP GUI), trading platforms, healthcare systems, and legacy enterprise software. When to Use - When condu…