Thick Application
Penetration Testing
Testing thick applications requires expert manual penetration testing skills and a thoughtful, methodical approach. NetSPI’s penetration testing service uses multi-vector testing to identify design and configuration weaknesses.
Improve application security with thick application penetration testing by NetSPI
Thick applications are still important for internal operations and often contain sensitive information. NetSPI identifies vulnerabilities in thick applications that make your organization susceptible to an external or internal threat.
During our thick application penetration testing service, NetSPI will evaluate your application for security vulnerabilities, and provide actionable guidance for remediating the vulnerabilities and improving application development and security program processes.
The NetSPI Difference
NetSPI delivers industry-leading penetration testing expertise and a vulnerability
management platform that makes penetration test results actionable.
Learn More arrow_forward
A collaborative team with experience and expertise produces the highest
quality of work
Our Thick Application Penetration Testing Service
NetSPI will test your thick application whether it is hosted internally or in a virtualized environment. NetSPI’s approach to thick application security assessments includes reviewing server-side controls, data communication paths, and potential client-related issues. We will employ manual and automated pentesting processes using commercial, open source, and proprietary software to evaluate your application.
Static Analysis
During the static analysis phase of testing, NetSPI will review the follow areas:
- Service account roles and permissions (client, application server, database server)
- Application file, folder, and registry permissions
- Application service, provider, WMI subscription, task, and other permissions
- Assembly compilation security flags
- Protection of data in transit
- Hardcoded sensitive data and authentication tokens (passwords, private keys, etc.)
- Hardcoded encryption material (keys, IVs, etc.)
- Use of insecure encryption and hashing algorithms
- Database user roles and permissions
- Database and server configurations
Dynamic Analysis
During the dynamic analysis phase of testing, NetSPI will test and review the following areas:
- Authentication and authorization controls enforced on the client and server
- Application user roles and permissions
- Application workflow logic between GUI elements
- Web Services utilized by the application using NetSPI’s web application testing methodology
- File system changes including file and folder creation, deletion, and modification
- Registry changes including creation, deletion, and modification of keys and values
- Application objects and information stored in memory during runtime
- Use of insecure encryption and hashing algorithms
- Network protocols utilized by the application (SMB, FTP, TFTP, etc.)
- Database connections
Application Pentesting
Research and Tools
Learn about network security testing on our blog, from our open-source penetration testing tool sets for the infosec community, and in our SQL injection wiki.
Benefits of Thick Application
Penetration Testing
Pentest your applications to:
Avoid breaches
Discover your vulnerabilities and exposure, before a breach occurs.
Achieve compliance
Meet application security testing requirements from a third-party.
Improve security
Learn how to strengthen your software development process.
Augment your team
Get a fresh set of eyes from penetration testing experts.