Thick Client Security Testing

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-pentest.md

2. NOW

   : Confirm the target is a desktop thick client (Win/macOS/Linux GUI or service-associated), not a pure Web client

3. NOW

   : case-init; Record the installation package source and test account in the scope

4. NEXT

   : Tools (Burp upstream proxy, process monitoring, reverse engineering tools)

5. ACT

   : Trust boundary diagram → Local surface → Network surface → Update/supply chain

Applicable Scenarios

• C/S architecture clients, Electron/Qt/.NET WinForms/WPF
• Local configuration/credential storage, IPC, named pipes
• Research on client-side mandatory verification bypass (authorization)
• Automatic update channels and code signature verification

Workflow

1. Establish Boundaries

□ Process tree, child processes, drivers/services
□ Listening ports and outbound domains
□ Local sensitive paths: %APPDATA%, Keychain, Registry

2. Local Attack Surface

□ Plaintext configuration, hardcoded keys, debug switches
□ DLL hijacking/search order (Windows)
□ Database file (SQLite) permissions and encryption
□ IPC: Who can connect? Is authentication required?

3. Network Surface

□ System proxy / application-specific TLS
□ Certificate pinning → Combine with mobile/js methodologies or Frida
□ API privilege escalation: Hidden admin interfaces on the client side

4. Reverse Verification

□ .NET → dotnet-reverse; Native → ida/ghidra; Electron → asar + js-reverse

Toolchain

References

• references/thick-client-checklist.md

• ../dotnet-reverse/

  ../ida-reverse/

  ../js-reverse/

  ../api-security/

Routing Context

protocol-reverse

supply-chain-security

Task Completion Self-Check

• Has the trust boundary diagram been drawn?
• Have both local and network surfaces been covered?
• Have checklists been completed?