Information Gathering

Along with application architecture, there are other things to identify as well before testing the thick client application. You need to understand the full functionality of the application including the languages and frameworks it is based on. If there are multiple users, then you should navigate through all the UI elements. Every user has different levels of permissions and access. There are unique functionalities you need to discover. Some users might have access to the administrative actions while some may not.

Languages like Dot Net, Java, C/C++, and Microsoft Silverlight are typically used to build thick client applications. Having information about the language the application is built on is necessary as well. You can use some specific tools for this task such as:

• CFF Explorer: A tool to make PE editing easier. It does that without any loss of sight upon the portable executable’s structure.
• PEid: Helps in the detection of common packers, cryptors, and compilers for PE files.
• Detect It Easy (DIE): Determines the file types for Windows, Linux, and macOS.
• Strings: A tool for scanning files passing through it for UNICODE or ASCII strings of a default length.

Selecting the method for Thick Client Pentesting

For thick client penetration testing, there are two key methods:

1. Black-Box Testing: It is the testing approach where the testers initiate the test without any prior knowledge about the app’s configurations. They carry out the testing of all functionalities of the application without any access to design, operation, and backend processes.
2. Grey-Box Testing: In this testing methodology, testers are provided with some basic information on the working infrastructure of the application. Before approaching the test, they also know about data flow within the application and API documentation.

Carrying out the thick client penetration test

Penetration testing for thick client applications needs a quite comprehensive approach. It mainly includes the following processes:

• Detailed analysis of tools and techniques deployed on client as well as the server-side
• Identification of all the functions and characteristics of the application
• Deciphering all the endpoints
• Anatomy of all the security protocols and measures already present to guard the application
• Scanning for vulnerabilities, loopholes, and security gaps in the application

Along with all this, there are 5 tracks of analysis in thick client pentesting:

1. Automated Scan
2. Configuration Analysis
3. Network Communication Analysis
4. Server Analysis
5. Client Analysis

Before You Go!

• Thick client pentesting is a lot trickier than conventional penetration testing. You need to consult an expert for the best result on it.
• With RSK Cyber security, you’ll get complete comprehensiveness and flexibility in pen testing for thick client applications. It is certainly among the best cybersecurity companies in Dubai.