Penetration Testing/Thick Client Penetration Testing

Thick Client Penetration Testing

Thick client penetration testing from the binary to the back end

Hands-on testing of your desktop applications, the files and memory they leave on the endpoint, the traffic they send and the servers they talk to. Every finding comes with a reproducible proof of concept and a fix your engineers can ship.

Windows, macOS and Linux apps, including .NET, Java, Electron and native code
Secrets in local files, memory and the registry
Client-to-server traffic, including custom protocols
Mapped to the OWASP Desktop App Security Top 10

Scope my thick client test See a sample report Talk to an expert →

The credentials behind every engagement

2026 CyberSecurity Breakthrough Awards winner

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026

Trusted by security teams at

See it in action

On the user's machine, the attacker holds every key.

We tamper with everything your desktop app keeps on the user's machine, then test what your server and app actually re-check.

Acme Trader · Desktop client— ☐ ✕

Signed in: danaTier: BasicEnterpriseRole: StandardAdminTAMPERED

User's machine · attacker controlled

What gets re-checked

Trust boundary

WindowsmacOSLinuxJava · .NET · Electron

Local config fileSettings and licence

tier = enterprise

Process memoryRuntime values

role = admin

Loaded librariesDLL search order

planted DLL loads

Traffic to the serverAPI requests

isAdmin: true

Licence tierServer

Re-checked on serverTrusted from clientRe-checked on server

User roleServer

Re-checked on serverTrusted from clientRe-checked on server

Library loadingApp

Re-checked on serverRuns attacker codeSigned, full paths

Admin APIServer

Re-checked on serverRequest acceptedRequest rejected

Exploitable paths01234BeforeAfter fixes, verified by retest

Swipe to see the full exhibit →

Assume the client is compromised

Files, memory and traffic on the user's machine can all be changed.

We test both sides of the boundary

We tamper with the app, then check what your server and app actually re-verify.

Every path closed and proven

Each finding comes with a fix, and we retest until the request is rejected.

Read this exhibit as text

Desktop apps on Windows, macOS and Linux, including Java, .NET and Electron apps, run on machines the user controls.
Editing the local config file to set the licence tier to enterprise works when the server trusts the tier the client sends.
Patching process memory to set the role to admin works when the server trusts the role the client sends.
A planted DLL is picked up through the library search order and runs attacker code inside the app.
Changing isAdmin to true in traffic to the server gets the admin request accepted.
After the fixes, the server re-checks the tier and the role, the app loads only signed libraries from full paths, and the admin API rejects the request. We retest each path until it is closed: four exploitable paths become zero.

Source: ioSENTRIX thick client testing methodology. Illustrative findings with a fictional app, not client data.

The short answer

What is thick client penetration testing?

Thick client penetration testing is a hands-on security test of a desktop application that runs code on the user's machine and talks to a server. Testers examine the installed binary, local files and memory, the network traffic and the back-end services, and prove each exploitable weakness with a reproducible proof of concept.

Desktop apps put logic and secrets on a machine the attacker controls. A desktop application penetration test checks what an ordinary user can change on their own endpoint, from patched binaries to replayed requests, and whether the server still enforces the rules. Findings map to the OWASP Desktop App Security Top 10, so engineers and auditors read the same evidence.

At ioSENTRIX, thick client penetration testing is carried out by hand by certified testers at a CREST-accredited firm, and every fix gets a free retest.

You need a thick client pentest if

You ship a desktop app to customers or employees
Your app stores credentials, tokens or licensing logic on the endpoint
A customer, auditor or regulator asked for a desktop app pentest report
The client talks straight to a database or uses a custom protocol

What we test

Four layers, tested by hand

Scope follows how your application is built. Most thick client tests cover these four areas.

Layer 1

Binary & code

What an attacker can learn or change in the installed application.

Decompilation & reverse engineering
Hardcoded secrets & keys
Client-side licensing & feature checks
Binary protections & tamper checks

Layer 2

Local storage & endpoint

What the app leaves behind on the user's machine.

Credentials in files, registry & memory
Insecure file & folder permissions
DLL search order hijacking
Logs & temp files with sensitive data

Layer 3

Network traffic

How the client talks to its servers.

Interception of HTTP & custom protocols
TLS & certificate validation
Replay & request tampering
Direct database connections

Layer 4

Server side

The APIs and services behind the client, tested like any other attack surface.

Authentication & session handling
Authorization enforced on the server
Injection in back-end calls
Update & installer channels

Methodology

How we test: example test cases

A sample of the manual test cases in a typical thick client penetration test. Your scope decides the full list.

DA1

Injection through client-built requests

We change the SQL, commands and parameters the client builds before they leave the machine, and check whether the server or local components run them.

DA2

Authentication decided by the client

We patch or replay the login flow to test whether the server, not the client, decides who is signed in and for how long.

DA3

Secrets on the endpoint

We search memory, config files, the registry and local databases for passwords, tokens and keys.

DA5

Hidden features unlocked

We re-enable hidden menus and disabled buttons in the client, then check whether the server still blocks those actions for a low-privilege user.

DA7

Traffic interception

We intercept traffic, including custom protocols, and test whether the client accepts a forged certificate or sends data in clear text.

DA9

Outdated bundled components

We inventory bundled libraries and runtimes and test whether known vulnerabilities in them can be reached through the application.

Sample finding

What a finding looks like in our report

An illustrative example in our report format. Not client data.

Finding 01 · IllustrativeHigh

Admin features disabled in the client are accepted by the server

OWASP DA5 Improper Authorization · CWE-602 Client-Side Enforcement of Server-Side Security

What we found

The desktop app hid admin functions from standard users by disabling menu items in the client. We patched one check in the .NET assembly, re-enabled the user management screen and created a new administrator. The server accepted the request because it trusted the role the client reported.

Impact

Any signed-in user can grant themselves administrator rights.

How to fix it

Enforce role checks on the server for every request, using the identity in the session token rather than values sent by the client. Treat the client as untrusted, and keep hidden menus for usability only.

What you get

What you get from every thick client pentest

Not a scan of the installer. Proven attacks on the app, the endpoint and the server, with fixes your engineers can act on.

Findings with proof, ranked by exploitability

Each finding has a severity, a reproducible proof of concept and remediation guidance, whether it sits in the binary, on the endpoint or on the server.

Mapped to the standards your customers ask about

Findings map to the OWASP Desktop App Security Top 10 and CWE, in a report your auditors and enterprise customers can read.

Walkthrough, then retesting

The tester who found each issue walks your engineers through it, and retesting is available once fixes land.

ioSENTRIX sample penetration test report cover

See how we write findings before you talk to us

A redacted sample penetration test report (web application): finding write-ups, proof-of-concept evidence and remediation. No form required.

Download the sample report (PDF) →

Verified reviews

What security leaders say about working with us

★★★★★

“Unlike other providers, Omair and his team truly dive deep into our infrastructure, delivering findings that go well beyond the surface level. Communication is direct and seamless.”

Jesus B.

Cybersecurity Manager, Banking

Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX’s ability to independently validate the security of our customer-facing product.”

Zeehasham R.

Data Scientist, Security Operations · Fortune 500 insurer

Verified Clutch review ↗

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.

SVP, Chief Information Security Officer

Verified G2 review ↗

How it works

How a thick client penetration test works

Four steps, so you know what happens and what you get.

Scope and architecture

We review how the client is built, what it stores and which servers it talks to, and agree what is in scope.

Start

Manual testing

Testers reverse the binary, inspect the endpoint, intercept traffic and attack the back end.

Most of the engagement

Report

Each finding has a severity, a reproducible proof of concept and remediation guidance.

At close

Remediation support

We walk your engineers through the findings, and retesting is available once fixes land.

After fixes

Reply in under an hour → scoping call → fixed quote in writing → testing, by scope → report, walkthrough and retest

How we compare

Not a scan of the installer. Not a web test that stops at the API.

What a thick client pentest covers compared with the usual alternatives.

ioSENTRIX thick client pentest

Automated scanner

Web app pentest only

What is tested

Binary, endpoint, traffic and server side

Known issues in files and dependencies

Server APIs; client and endpoint out of scope

Client-side controls

Patched and bypassed by hand

Not tested

Custom protocols

Intercepted and tampered with

Rarely

Only if they run over HTTP

Evidence

Reproducible proof of concept and a fix

Findings to triage

Finding list

Standards

OWASP Desktop App Security Top 10, CWE

Varies by tool

OWASP Top 10 (web)

Scope my thick client test

Scope and price

What affects the scope and price of a thick client pentest

Thick client tests are priced on effort. These are the decisions that move the quote.

What moves the quote

01How many applications, modules and user roles are in scope
02The technology: .NET, Java, Electron or native code
03Whether the client uses HTTP or a custom protocol
04Whether the back-end APIs and services are tested in the same engagement
05Black-box testing, or access to source code and architecture notes
06Retesting windows and the report format your customers expect

Read: Penetration Testing Cost & Pricing in 2026: What a Pentest Really Costs →

What we need from you to start

Installers or builds for each platform in scope
Test accounts for each user role
A test back end or staging environment that mirrors production
Notes on protocols, servers and third-party components
A technical contact for questions during testing

Scope my thick client test

Case studies

Engagements we have run

Anonymized examples of ioSENTRIX engagements. Clients are described by industry, not named.

Advisory services

Full-stack penetration test

A Citrix-hosted web application handling legal and financial data, tested across the application, its dependencies, infrastructure and internal network.

Read the case study →

Track record

Numbers you can check

Ratings you can verify on G2 and Clutch.

4.9 / 5

on G2 from 12 verified reviews

5.0 / 5

on Clutch, Premier Verified

2017

founded; CREST-accredited, ISO 27001 certified, SOC 2 Type 2 attested

Independently verified

Credentials held by the firm

Every engagement runs inside a company whose methods and own security are checked by outside bodies.

CREST-accredited for penetration testing

CREST assesses the firm's testing methodology, quality assurance and handling of client data.

View our CREST listing →

SOC 2 Type 2 attested

An independent auditor tested our own security controls over time.

Request the SOC 2 report →

ISO/IEC 27001 certified

Our information security management system is certified to ISO/IEC 27001.

View in our trust center →

Recognized independently

Penetration Testing Solution of the Year, 2026 CyberSecurity Breakthrough Awards. G2 High Performer, Fall 2026.

Award announcement →See our G2 reviews →

Founded in 2017.

Our commitments

What you can count on

Four promises we make on every testing engagement.

Free retest of every fixOnce your team fixes a finding, we test it again at no extra cost and update the report.
A fixed priceThe quote you sign is what you pay. The price only changes if you change the scope.
A report your auditor acceptsIf your auditor has questions about the report, we answer them and update it until it is accepted.
A reply in under an hourSend the form and we reply within an hour during US business hours.

Get a scoped quote

For your buying team

Everything your reviewers will ask for

Security, finance and procurement each need something different. Forward this page, or pull what each reviewer needs.

For security

Sample report

See exactly what you get: findings, proof of concept, fixes and retest results.

Download the sample report (PDF) →

For vendor risk

Trust center

Our SOC 2 Type 2 report and security documentation for your vendor review.

Open the trust center →

For procurement

Procurement pack

Master services agreement, sample statement of work, certificate of insurance and W-9.

Request the procurement pack →

For your team

Share this page

Send the link to the people who need to sign off.

Who you work with

Who does the work

Senior security engineers do the hands-on work and write up the results, so the person who found an issue explains it to your team.

Certified engineers

Each engineer holds one or more of OSCP, OSWE, OSCE, CISSP, CISA or AWS security certifications.

Accredited firm

ioSENTRIX is CREST-accredited for penetration testing, ISO/IEC 27001 certified and SOC 2 Type 2 attested.

Since 2017

Founded in 2017, with security work for Fortune 100, financial services, insurance and SaaS companies.

Ready to see what your desktop app gives away?

We reply in under an hour · no sales pitch

Scope my thick client test

Standards

Frameworks we test and map to

◆OWASP Desktop App Security Top 10 (2021)◆OWASP Web Security Testing Guide (WSTG)◆CWE◆NIST SP 800-115◆PTES

FAQ

Frequently asked questions

What is the difference between a thick client and a thin client?

A thin client, such as a browser, mostly displays what the server sends. A thick client runs much of its logic on the user's machine and often stores data there. That extra code and data on the endpoint is what a thick client pentest examines.

Which platforms and technologies do you test?

We test desktop applications on Windows, macOS and Linux, including .NET, Java, Electron and native C or C++ code. Tell us what you ship and we will confirm the approach on the scoping call.

Do you test the server side as well?

Yes, when it is in scope. Many serious thick client findings involve a server that trusts the client, so we usually test the APIs behind it in the same engagement. See our web application and API penetration testing.

Do you need our source code?

No. We can test the installed application as a black box. Source code or architecture notes let us cover more in the same time, so many clients share them.

How long does a thick client pentest take?

Most thick client tests run days to weeks, depending on the number of applications, roles and protocols in scope. We reply in under an hour during US business hours, and the scope, timeline and fixed quote follow the scoping call.

Resources

Go deeper before you scope a test

Practical guides from our testers on the questions buyers ask most.

Guide · 5 min read

Choosing the Right Pentesting Approach: Automated or Manual?

Description Looking for penetration testing services to protect your organization against cyber threats? Discover the pros and cons of good vs. cheap…

Read the guide →

The five stages of penetration testing: reconnaissance, scanning, vulnerability assessment, exploitation and reporting

Guide · 10 min read

The 5 Stages of Penetration Testing: Phases, Steps and Process Explained

The five stages of penetration testing explained step by step, mapped to the seven PTES phases and NIST SP 800-115, and what the last stage should…

Read the guide →

Guide · 6 min read

The Dangers of Cheap Penetration Test

Exploring the hidden risks and potential pitfalls of opting for cheaper penetration testing services.

Read the guide →

Keep exploring

Related services

HubAll penetration testing services ServiceWeb application & API penetration testing ServicePenetration testing as a service (PTaaS)ServiceApplication security services ServiceNetwork penetration testing ServiceMobile app penetration testing

Ready when you are

Test your desktop app before an attacker does

Tell us what you ship and who uses it. We will scope a test and send a fixed quote based on effort.

We reply in under an hour · Fixed quote in writing before work starts · Your details are never shared