Thick Client Application Penetration Testing
Skip the app. Ask the database.
Your desktop app holds the database password, so anyone with the binary never needs to log in at all. A senior U.S. engineer reads the connection string out and queries your data directly.
Decompiled client
// AcmeERP.exe · dnSpy
var conn = "Server=db.acme.local;
User Id=sa;
Password=P@ssw0rd!;"The database's own password, in the binary.
Login requiredRole enforcedSigned buildDirect to the database
$ sqlcmd -S db.acme.local -U sa
1> SELECT * FROM Customers;
2> GO
→ 48,201 rows.
No app. No login. No log.DB creds in the binary. Critical.
- Login required What the app enforces
- Password=… What the binary handed over
Nothing replaces skill. Illustrative binary, synthetic credential. The app checks your login; the database never sees it.
Reverse Engineering
Local Storage & Config
Config files, caches, registry keys, and local databases read for credentials and sensitive data.
Memory Analysis
The running process, examined for credentials and tokens held longer than they should be.
Traffic Interception
Cleartext transmission, weak encryption, and SSL pinning that a standard proxy walks past.
Control Tampering
We patch the binary and hook functions to defeat license checks and authentication the app assumes only it can enforce.
Backend & API Abuse
The databases, APIs, and services the client connects to, tested with the access the client hands over.
Hardcoded Secrets
API keys, database passwords, and encryption keys compiled into the executable, recoverable by anyone with the binary.
Cleartext Local Storage
Credentials and sensitive data cached on disk without encryption.
Client-Side Auth
Login and authorization enforced only on the client, bypassed by patching one function.
Bypassable Encryption
Homegrown crypto, hardcoded keys, and SSL pinning that falls to standard interception.
Overprivileged Backend
Clients that connect to the database with far more privilege than the user needs.
Exposed Debug Features
Hidden menus, verbose logging, and developer functions left in production builds.
.NET & WPF
Windows desktop apps, including WinForms and WPF, where decompilation and patching are often straightforward.
Java
Cross-platform clients whose bytecode is readily decompiled and inspected.
C & C++ Native
Compiled native apps that call for deeper reverse engineering, memory analysis, and binary patching.
Electron & Hybrid
Web technology in a desktop shell, exposing both thick-client and web vulnerability classes.
Two-Tier Database Clients
Apps that connect straight to a backend database, holding credentials an attacker can reuse.
ERP & Line-of-Business
Custom and vendor clients that handle sensitive data and integrate deep into internal systems.
Technical Report
Every finding with proof, reproduction steps, impact, and a fix.
Executive Summary
A board-readable read on the risk and what to do about it.
Attack Storyboard
The whole path, from the binary to the data it reached.
Included Retest
We verify the fix and issue a clean report, at no extra cost.
FAQ: Thick Client Penetration Testing
What is thick client penetration testing?
It is a security test of a desktop application, one that runs on a user's own machine and holds real logic and data locally. Our engineers work from an installed build the way an attacker would: decompiling the binary, reading its secrets, tampering with its controls, and abusing the databases and services it connects to.
How is it different from a web application penetration test?
A web app runs on a server you control, so the attacker only sees what you send them. A thick client runs on the attacker's machine, so they have the binary, the local files, and the memory. That opens up reverse engineering, local storage attacks, and client-side tampering that a web application test never has to consider.
Do you need our source code?
No. We work from a compiled build, the same starting point a real attacker has. Source access can speed up a review and help us reach deeper coverage, so we are glad to use it when you can share it, but it is never required.
What do we need to provide?
A working installer or build, test credentials and a test environment for the backend it talks to, and a point of contact. If the application needs specific hardware, a license, or a particular OS to run, we will confirm that during scoping.
Will testing affect our production systems or backend?
We prefer to test against a staging or test backend so there is no risk to production data. When only production is available, we avoid disruptive techniques by default, flag anything sensitive during kickoff, and agree on limits with you before we start.
Can you test the backend APIs and database at the same time?
Yes, and it usually surfaces the highest-impact findings. Thick clients often talk to their backend APIs and databases with broad privileges. Once we recover those credentials from the client, we test what that access actually unlocks. We scope the backend into the engagement so the two are tested together.
What kinds of thick client applications do you test?
.NET and WPF, Java, native C and C++, Electron and other hybrid apps, two-tier database clients, and custom ERP or line-of-business tools. If it installs and runs on a desktop and talks to a backend, we can test it. Tell us the framework during scoping and we will confirm our approach.
How long does a thick client penetration test take?
Most engagements run one to two weeks, including reporting. Reverse engineering a large native application, or testing a wide backend behind it, moves it toward the longer end. We give you a firm timeline once scope is set.
Does this help with compliance?
Yes. When a desktop application handles regulated data, testing it supports PCI DSS, HIPAA, SOC 2, and similar frameworks, and satisfies auditors who expect application-layer testing beyond the network. Raxis reports include an attestation letter you can share with customers and partners.
Who performs the testing?
Senior US-based Raxis engineers holding certifications such as OSCP and OSCE. No outsourcing, and no junior testers learning on your application.