Thick and Thin Client Security Testing
for Critical Desktop Apps
Thick clients often hold credentials, business logic and direct database connections, while thin clients delivered through Citrix or VDI can open a path into the wider network. We test the binary, local data, network traffic and the server it trusts, and try to break out of published applications.
Thick client security testing
Deep Testing for Desktop, Two-Tier, Three-Tier and Virtualised Applications
Every finding is validated by a tester and traced to the component that causes it, whether that is the client, its protocol or the server behind it, with a fix your developers can apply.
100%
Findings manually validated by a tester
6
Phase, standards-aligned methodology
40+
Enterprise and government clients
15+
Countries served
Why iSpyCyber
Why Organisations Choose iSpyCyber for Thick Client Testing
Desktop applications often trust the client far more than they should. We test both sides of that trust.
Client and server together
We test the desktop binary, its protocol and the server components behind it, not just the screen a user sees.
Local data and memory
We find and assess credentials, keys and sensitive records left in files, the registry, configuration and process memory.
Traffic interception
We intercept and tamper with HTTP, proprietary TCP and database protocols to test what the server really checks.
Citrix and VDI breakout
Published apps and virtual desktops are tested for escape to the host and lateral movement into your network.
Near-zero noise
Every issue is reproduced by hand before it reaches the report, so your team only spends time on real findings.
Continuous validation
Retesting confirms each fix, and iefyx, our AI-native VAPT platform, keeps exposure visible between engagements.
Coverage
What We Test in Your Thick and Thin Clients
Testing draws on the OWASP Desktop App Security Top 10 and covers the client, its traffic and the servers behind it.
Binary analysis
Decompilation of .NET, Java and native binaries, hard-coded secrets, obfuscation and code signing.
Local storage
Credentials and sensitive data in files, the registry, logs, caches and temporary folders.
Memory analysis
Passwords, tokens and decrypted data held in process memory and memory dumps.
Traffic and protocols
HTTP, TCP, UDP and database traffic, plus TLS certificate validation.
Authentication and authorisation
Client-side-only controls, role bypass and hidden privileged functions.
Two-tier database access
Direct connections, shared credentials, SQL injection and excessive database privileges.
DLL and process attacks
DLL hijacking, insecure permissions, unquoted service paths and privilege escalation on the host.
Citrix and VDI breakout
Escape from published apps and kiosk restrictions through the clipboard, drive mapping and printing.
Update and configuration
Auto-update integrity, installer permissions, debug features and insecure configuration files.
Methodology
A Six-Phase Thick Client Testing Methodology
Aligned to the OWASP Desktop App Security Top 10 and NIST SP 800-115, with every finding risk-rated using CVSS.
Phase 01
Scope and plan
We agree the applications, versions, user roles and test environment, and the rules of engagement.
Output: Signed scope and test plan
Phase 02
Map the architecture
We map the client, its servers, protocols and trust boundaries, including two-tier and three-tier designs.
Output: Architecture and data-flow map
Phase 03
Analyse the client
Binary, local storage and memory analysis on a test workstation, using the roles you provide.
Output: Client-side findings
Phase 04
Intercept and exploit
Testers intercept and tamper with traffic, attack the server side and confirm each issue by hand.
Output: Evidence for each finding
Phase 05
Report and debrief
A risk-rated report with evidence and fixes, walked through with your engineering and leadership teams.
Output: Report and debrief session
Phase 06
Fix and retest
After you remediate, we retest each finding and issue an updated report confirming closure.
Output: Retest report
Engagement models
Choose the Testing Approach That Fits Your Risk
The more we know about the application, the deeper we can test in the same time.
Black box
We test with only the installer and a standard user account.
Best for: Seeing what any user or insider could do
Grey box
The installer, accounts for each role and architecture notes, for deeper coverage in the same time.
Best for: Most business applications
White box
Adds source code and design documents, so we can trace each flaw to its root cause.
Best for: Banking, trading and other high-risk desktop apps
Not sure which approach you need?
Tell us about your environment and we will recommend the right scope.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Executive summary
Business risk in plain language, with an overall rating and the issues leadership needs to know about.
Technical findings
Each finding with affected components, evidence, a CVSS rating and step-by-step remediation.
Remediation roadmap
Fixes prioritised by risk and effort, for both the client and the server side.
Retest report
Confirmation of which findings are closed, for your records, auditors and customers.
Standards
Supports Your Compliance and Assurance Requirements
- OWASP Desktop App Security Top 10
- OWASP ASVS
- NIST SP 800-115
- ISO/IEC 27001
- SOC 2
- PCI DSS
- RBI guidelines
- SEBI CSCRF
- DPDP Act 2023
- CERT-In guidelines
iSpyCyber provides testing and evidence that support these requirements. Certification and attestation are issued by accredited bodies and auditors.
FAQ
Thick client security testing questions, answered
The basics
What is thick client security testing?
A security assessment of desktop applications that run part of their logic on the user’s machine, together with the servers they talk to. It finds weaknesses in the binary, local data, network traffic and server-side checks.
What is the difference between thick and thin client testing?
A thick client does much of its processing locally and may connect straight to a database. A thin client, such as an app published through Citrix or VDI, runs on a server, so testing focuses on breaking out of the published app and moving into the wider network.
Do you test Java, .NET and native applications?
Yes. Our coverage includes decompiling .NET, Java and native binaries, along with their local storage, memory and network traffic.
Working with us
What do you need from us to start?
The installer or a test workstation, user accounts for each role, and details of the servers and environments in scope. Architecture notes and source code are optional and allow deeper testing.
Will testing affect our live systems?
We prefer a test or staging environment. If testing must touch production, we agree time windows and limits with your team in advance.
How long does a thick client test take?
It depends on the size of the application, the number of roles and whether the server side is in scope. We confirm the timeline in our proposal after a short scoping call.
Do you retest after we fix the issues?
Yes. Once you have remediated, we retest each finding and issue an updated report confirming which issues are closed.
Still have a question? Talk to our security team.