Thick client application penetration testing
Testing thick client applications for security vulnerabilities requires expert manual penetration testing skills and a thoughtful, methodical approach. NetSPI’s thick client app penetration testing uses multi-vector cybersecurity testing to identify design and configuration weaknesses.
Benefits of thick client application penetration testing
Thick client applications are important for internal operations. They are often deployed to interact with sensitive data such as health records and financial information and can prove to be a large area of risk for an organization — especially if they are legacy applications. NetSPI identifies vulnerabilities in thick applications that make your organization susceptible to an external or internal security threat.
Thick application testing methodology
NetSPI tests your thick client application whether it is hosted internally or in a virtualized environment. Our approach to thick client application security assessments includes reviewing server-side and client-side security controls, data communication paths, data storage, and authorization/authentication best practices. We employ manual and automated pentesting processes using commercial, open source, and proprietary cybersecurity testing tools to evaluate your application.
What does NetSPI test for?
NetSPI focuses on the following areas during thick client application penetration testing to ensure complete and comprehensive coverage.
Static Analysis
During the static analysis phase of testing, NetSPI reviews the following areas:
- Service account roles and permissions (client, application server, database server)
- Application file, folder, and registry permissions
- Application service, provider, WMI subscription, task, and other permissions
- Assembly compilation security flags
- Protection of data in transit
- Hardcoded sensitive data and authentication tokens (e.g. passwords, private keys)
- Hardcoded encryption material (e.g. keys, IVs)
- Use of insecure encryption and hashing algorithms
- Database user roles and permissions
- Database and server configurations
Dynamic Analysis
During the dynamic analysis phase of testing, NetSPI tests and reviews the following areas:
- Authentication and authorization controls enforced on the client and server
- Application user roles and permissions
- Application workflow logic between GUI elements
- Web services utilized by the application
- File system changes including file and folder creation, deletion, and modification
- Registry changes including creation, deletion, and modification of keys and values
- Application objects and information stored in memory during runtime
- Use of insecure encryption and hashing algorithms
- Network protocols utilized by the application (e.g. SMB, FTP, TFTP)
- Database connections
You deserve The NetSPI Advantage
Security experts
- 300+ pentesters
- Employed, not outsourced
- Domain expertise
Intelligent process
- Programmatic approach
- Strategic guidance
- Delivery management team
Advanced technology
- Consistent quality
- Deep visibility
- Transparent results
