Thick client security testing

When it applies

The engagement includes a desktop application — a client-server (C/S) client built on Electron, Qt, .NET WinForms/WPF, or native code — rather than a pure web app. Typical triggers: an installer in scope, credentials cached locally, an auto-updater, a loopback port or named pipe, or API calls the UI never exposes. Record the installer source and the test accounts in scope.txt (tradecraft-scope-roe); test only machines and accounts you're authorized for.

Why it works

A thick client is a server-side trust boundary shipped to an attacker-controlled machine: everything it stores, every check it enforces locally, and every API it knows how to call is yours to read. The client cannot keep secrets from its operator — so hardcoded keys, hidden admin endpoints, and client-enforced validation are structural findings, not luck.

Method

Work boundary → local surface → network surface → reverse-engineering confirmation.