Thick Application Penetration Testing

Testing thick client applications requires expert manual penetration testing skills and a thoughtful, methodical approach. NetSPI’s thick app penetration testing service uses multi-vector testing to identify design and configuration weaknesses.

Thick-App_Main

Improve Application Security

NetSPI’s thick application penetration test reduces organizational risk and improves application security

Thick applications are important for internal operations and often contain sensitive information. NetSPI identifies vulnerabilities in thick applications that make your organization susceptible to an external or internal threat.

During our thick application penetration testing service, NetSPI evaluates your application for security vulnerabilities, and provide actionable guidance for remediating the vulnerabilities and improving application development and security program processes.

Our penetration testers find 20% more vulnerabilities by using our Resolve™ platform and proven methodology.

What Does NetSPI Test For?

  • Injection
  • Broken authentication
  • Sensitive data exposure
  • XML external entities (XXE)
  • Broken access control
  • Security misconfiguration
  • Cross-site scripting (XSS)
  • Insecure deserialization
  • Components with known vulnerabilities
  • Insufficient logging and monitoring

Our Thick Application Penetration Testing Service

NetSPI tests your thick application whether it is hosted internally or in a virtualized environment. Our approach to thick client application security assessments includes reviewing server-side controls, data communication paths, and potential client-related issues. We employ manual and automated pentesting processes using commercial, open source, and proprietary software to evaluate your application.

Static Analysis

During the static analysis phase of testing, NetSPI reviews the follow areas: 

  • Service account roles and permissions (client, application server, database server) 
  • Application file, folder, and registry permissions 
  • Application service, provider, WMI subscription, task, and other permissions 
  • Assembly compilation security flags 
  • Protection of data in transit 
  • Hardcoded sensitive data and authentication tokens (passwords, private keys, etc.) 
  • Hardcoded encryption material (keys, IVs, etc.) 
  • Use of insecure encryption and hashing algorithms 
  • Database user roles and permissions 
  • Database and server configurations

Dynamic Analysis

During the dynamic analysis phase of testing, NetSPI tests and reviews the following areas: 

  • Authentication and authorization controls enforced on the client and server 
  • Application user roles and permissions 
  • Application workflow logic between GUI elements 
  • Web services utilized by the application using NetSPI’s web application testing methodology 
  • File system changes including file and folder creation, deletion, and modification 
  • Registry changes including creation, deletion, and modification of keys and values 
  • Application objects and information stored in memory during runtime 
  • Use of insecure encryption and hashing algorithms 
  • Network protocols utilized by the application (SMB, FTP, TFTP, etc.) 
  • Database connections

Powered by Resolve™

Web application engagements are managed and delivered through Resolve, NetSPI’s vulnerability management and orchestration platform. Resolve elevates your vulnerability management and pentesting program.

Pentesting Research and Tools

Learn about penetration testing on our blog, our open source penetration testing toolsets for the infosec community, and our SQL injection wiki.