<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: performing-thick-client-security-testing
subdomain: security-testing
title: "Performing Thick Client Security Testing"
tags:
  - thick-client
  - desktop-security
  - binary-analysis
  - reverse-engineering
  - IPC
metadata:
  mitre-attack: ["T1190"]
---

# Performing Thick Client Security Testing

> Assess security of desktop and thick client applications including binary analysis, local storage, inter-process communication, and network protocol testing.

## Overview

Thick client security testing evaluates desktop applications for vulnerabilities in binary code, local data storage, network communications, and inter-process interactions. This technique covers static analysis, dynamic testing, reverse engineering, and memory forensics for thick client applications.

## Core Concepts

- **Binary analysis**: Reverse engineering, decompilation, and code review of compiled applications
- **Local storage testing**: Credentials, tokens, and sensitive data stored on disk or registry
- **Network protocol analysis**: Intercept and manipulate client-server communications
- **IPC testing**: Assess inter-process communication channels for injection and tampering
- **Memory analysis**: Extract secrets and sensitive data from application runtime memory

## Workflow

1. Inventory thick client components and deployment architecture
2. Perform static analysis of application binaries
3. Identify local storage locations and data sensitivity
4. Set up network interception proxy for protocol analysis
5. Test authentication and session management mechanisms
6. Analyze inter-process communication channels
7. Perform memory analysis for sensitive data exposure
8. Test update mechanisms for integrity and authenticity
9. Assess DLL hijacking and binary planting vectors
10. Document findings with exploitation proof-of-concepts

## Implementation

```python
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class ClientPlatform(Enum):
    WINDOWS = "windows"
    MACOS = "macos"
    LINUX = "linux"
    CROSS_PLATFORM = "cross_platform"


class TestCategory(Enum):
    BINARY_ANALYSIS = "binary_analysis"
    LOCAL_STORAGE = "local_storage"
    NETWORK = "network"
    IPC = "ipc"
    MEMORY = "memory"
    UPDATE_MECHANISM = "update_mechanism"


@dataclass
class ThickClientFinding:
    title: str
    severity: str
    category: TestCategory
    description: str
    proof_of_concept: str
    remediation: str
    cwe: str | None = None


class ThickClientTester:
    """Thick client application security testing framework."""

    def __init__(self, app_name: str, platform: ClientPlatform) -> None:
        self.app_name = app_name
        self.platform = platform
        self.findings: list[ThickClientFinding] = []
        self.components: list[dict] = []

    def add_component(self, name: str, component_type: str, path: str) -> None:
        self.components.append({"name": name, "type": component_type, "path": path})

    def add_finding(self, finding: ThickClientFinding) -> None:
        self.findings.append(finding)

    def findings_by_category(self, category: TestCategory) -> list[ThickClientFinding]:
        return [f for f in self.findings if f.category == category]

    def test_summary(self) -> dict:
        return {
            "application": self.app_name,
            "platform": self.platform.value,
            "components": len(self.components),
            "total_findings": len(self.findings),
            "critical": sum(1 for f in self.findings if f.severity == "critical"),
            "high": sum(1 for f in self.findings if f.severity == "high"),
            "categories_tested": list({f.category.value for f in self.findings}),
        }
```

## Best Practices

- Test in an isolated environment—thick clients may modify system state
- Check for hardcoded credentials and API keys in application binaries
- Verify certificate pinning for client-server communications
- Test with both admin and standard user privilege levels
- Assess auto-update mechanisms for man-in-the-middle vulnerabilities
- Document DLL search order for hijacking risk assessment on Windows

## Detection

```yaml
title: Thick Client Security Testing Detection
id: 9575797a-0b55-47e1-aedf-6a62d7465fab
status: experimental
description: Detects suspicious activity related to performing thick client security testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*thick*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Thick Client Security Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Related Techniques

- [Performing Database Security Testing](../performing-database-security-testing/SKILL.md)
- [Building Security Testing Methodology](../building-security-testing-methodology/SKILL.md)
