Thick Client
Penetration Testing
A full evaluation of desktop/thick-client applications, including binary analysis, runtime manipulation, and communication security. Thick clients run on machines attackers fully control.
Starting at $7,000 per engagement
Reverse Engineering Expertise
Memory-level analysis with full backend integration testing
What We Test
Full-scope testing across all thick client attack vectors.
Static Binary Analysis
Decompilation, code review, hardcoded secrets, and insecure configurations.
Dynamic Runtime Manipulation
Debugging, hooking, and runtime modification of application behavior.
Memory Inspection
Extract sensitive data from process memory, including credentials and tokens.
DLL Hijacking
Identify and exploit insecure DLL loading paths for privilege escalation.
Local Storage Review
Configuration files, databases, registry keys, and credential storage.
TLS & Certificate Validation
Verify secure communication, certificate pinning, and traffic interception resistance.
Why Thick Client Security Matters
A thick client runs on hardware the attacker owns. Every check the application performs locally — the license validation, the role that decides which menu appears, the price the order screen sends to the server — is a check the user can watch, change, or skip entirely. Secrets compiled into the binary ship identically to every customer who installs it, so one leaked connection string or API key is a leak across your whole install base. Credentials and session tokens sit in process memory long after login. A configuration file or registry key that any local user can write turns a standard workstation account into an administrator.
We test the application the way someone who already has a copy of it would. Static analysis decompiles the binary and hunts hardcoded secrets and insecure defaults. Dynamic testing attaches a debugger, hooks functions, and modifies behavior at runtime to find out which client-side controls the server actually re-validates and which ones it simply trusts. We pull credentials and tokens out of process memory, review local storage — configuration files, embedded databases, registry keys — check DLL loading paths for hijacking that leads to privilege escalation, and intercept traffic to the backend to confirm TLS validation and certificate pinning hold. A web application test shows an attacker your requests. A thick client hands them your code.
Every engagement is run by an experienced tester, not a scanner with a report template. You get findings with reproduction steps and risk ratings your developers can work from, remediation guidance, and a free retest within 30 days to confirm the fixes hold. We work with organizations across the Charlotte, NC area and nationwide.
Prevent Local Privilege Escalation
Identify vulnerabilities that could allow attackers to gain elevated access on endpoints.
Protect Sensitive Data
Ensure credentials and sensitive data aren't exposed in memory or local storage.
Identify Reverse Engineering Risks
Assess how easily attackers can decompile and understand your application logic.
Free Retesting
Complimentary retest of all findings within 30 days to validate remediation.
Related Services
Explore other security assessments that complement this service.
Web Application Testing
Thorough manual testing of your web applications against the OWASP Top 10 and beyond.
Learn moreMobile App Testing
Security evaluation of iOS and Android applications including reverse engineering and backend communication.
Learn moreAPI Security Testing
Full-scope testing of REST, GraphQL, and other API architectures against the OWASP API Top 10.
Learn moreFrequently Asked Questions
How much does thick client penetration testing cost?
Thick client penetration testing starts at $7,000. Final pricing depends on whether source code is available, the client-server communication protocol, and the platforms (Windows, macOS, Linux) in scope. Get a free, scoped quote within 24 hours.
What is a thick client application?
A thick client is installed desktop software that does significant processing on the user’s own machine instead of in a browser, then talks to a backend server or database. Business applications, engineering and design tools, point-of-sale software, and internal admin consoles on Windows, macOS, or Linux all fall into this category.
How is thick client testing different from web application testing?
The attacker controls the runtime. With a thick client they can decompile the binary, attach a debugger, read process memory, and change how the application behaves while it runs — none of which is possible against server-side code. That is why we test client-side controls specifically for whether the server re-validates them. If your product has both, pair this with a web application penetration test.
Do you need our source code to test?
No. We test the compiled application the way an attacker with a copy of the installer would, starting from decompilation and runtime analysis. Source code is optional and changes the scope and the price, which is why we ask about it during scoping.
Do you test the backend the application connects to?
Client-server communication is in scope: we intercept the traffic, verify TLS and certificate validation, test certificate pinning, and check what the server accepts once the client has been modified. Full testing of the backing API or web service is a separate scope item we can add to the same engagement.
How long does thick client testing take, and how soon can you start?
Timeline depends on the size of the application, whether source code is available, and how many platforms are in scope. We put the exact testing window in your proposal, which you receive within 24 hours of scoping, and we can typically begin within 24 hours of approval.
What do we receive at the end?
An executive summary for leadership, technical findings with CVSS scoring, proof-of-concept, and step-by-step reproduction steps, and remediation guidance prioritized by risk. Every engagement also includes a complimentary retest within 30 days so your team can confirm the fixes worked.
Ready to Secure Your Desktop Application?
Get a customized proposal within 24 hours. No sales calls, no pressure.
Get Started Book a Call