Thick Client

---
name: thick-client
description: Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
---

# Thick Client Security Testing

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: Read `../field-journal/precedent-pentest.md`
2. `NOW`: Confirm the target is a **desktop thick client** (Windows/macOS/Linux GUI or an accompanying service), not a pure web app
3. `NOW`: case-init; record the installer source and test accounts in the scope
4. `NEXT`: tools (Burp upstream proxy, process monitoring, reverse-engineering tools)
5. `ACT`: Trust-boundary map → local surface → network surface → update/supply chain

## Applicable Scenarios

- C/S architecture clients, Electron/Qt/.NET WinForms/WPF
- Local configuration/credential storage, IPC, named pipes
- Client-side enforcement bypass research (authorized)
- Auto-update channels and code-signing verification

## Workflow

### 1. Map the Boundaries

```text
□ Process tree, child processes, drivers/services
□ Listening ports and outbound domains
□ Local sensitive paths: %APPDATA%, Keychain, registry
```

### 2. Local Attack Surface

```text
□ Cleartext configuration, hardcoded keys, debug switches
□ DLL hijacking/search order (Windows)
□ Database files (SQLite) permissions and encryption
□ IPC: who can connect? Is it authenticated?
```

### 3. Network Surface

```text
□ System proxy / application-custom TLS
□ Certificate pinning → combine with mobile/js methodologies or Frida
□ API privilege abuse: admin interfaces hidden in the client
```

### 4. Reverse-Engineering Validation

```text
□ .NET → dotnet-reverse; native → ida/ghidra; Electron → asar + js-reverse
```

## Toolchain

| Tool | Purpose |
|------|---------|
| Process Monitor / API Monitor | Behavior |
| Burp / mitmproxy | Traffic |
| dnSpy / IDA / Ghidra | Reverse engineering |
| Sysinternals | Windows surface |
| asar / nexe detection | Electron |

## References

- `references/thick-client-checklist.md`
- `../dotnet-reverse/` `../ida-reverse/` `../js-reverse/` `../api-security/`

## Routing Context

**Upstream**: MASTER R32  
**Downstream**: pure protocols `protocol-reverse`; update supply chain `supply-chain-security`

## Task Completion Checklist

- [ ] Was the trust boundary mapped?
- [ ] Were both local and network surfaces covered?
- [ ] Checklist?