Applications
Rich client applications
Examination of desktop applications (C#, .NET and other programming languages) for misconfigurations and vulnerabilities.
Scope of the pentest
Our experts test your desktop application for typical vulnerabilities in configuration management, communication with backend systems and in the source code in general. The test can be conducted on premises or remotely.
Exemplary test objects:
2-TIER architecture
Desktop application in a 2-tier architecture consisting of the client side (front end, rich client application) and the server side (back end, database).
3-TIER architecture
Desktop application in a 3-tier architecture consisting of the client side (frontend, rich client application), the application logic (middleware, API) and the server side (backend, database).
39%
In 39% of cases attackers can gain unauthorized application access. ¹
16% of all systems can be fully compromised. ¹
Penetration testing of rich client applications
Our approach
The penetration test presented here includes a comprehensive security analysis of your rich client application at the network and application level.
For the pentest, you provide us with access to a VDI/VM or a client device on which the desktop application is already be installed and usable. Alternatively, if technical feasable, you provide us with the installer binary and all necessary configuration files to run the rich client on our own hardware/infrastructure.
From the perspective of an attacker with access to the desktop application, we examine the application for typical misconfigurations and vulnerabilities in the following areas:
- Insecure storage of sensitive data (configuration and access data on the local hard disk or in the source code)
- Authentication and session management
- Authorization and authorization concept
- Communication encryption (Client <> API <> Backend)
- Input validation
- Vulnerabilities in the direct source code (reverse engineering)
- Options for KIOSK breakout, if used
- Options for DLL sideloading during execution or installation
- and many other test
During the penetration test, we check the entire lifecycle of your desktop application, from installation on the client side to communication with an API middleware and the backend systems.
Desktop applications offer a high risk potential, as the application and communication runs or is initiated on an end device that tends to be under the control of an attacker.
Our experience shows that 2-TIER architectures are particularly susceptible to privilege escalations. In addition, rich client applications are often run on non-hardened client endpoints or RDP environments, which make it easy to breach and compromise IT systems and data.
Standards and qualifications
We follow recognized international standards for our pentest procedure.
Our penetration testers are highly qualified and certified with several recognized hacking certificates.
