Testing Thick Clients

A thick client puts part of the application on the tester's own machine, and that is the whole opportunity: the binary, its config, its memory, and its traffic are all reachable. The recurring failure in these apps is trusting the client — enforcing authorization, hiding functionality, or holding secrets on a box the user controls. The job is to enumerate that surface and show where the trust is misplaced.

When to Use

• Assessing an installed desktop application (.NET/WPF, Java/Swing, Electron, Qt, native Win32) that communicates with a backend
• A fat client where Burp shows nothing because the traffic is not HTTP or not proxy-aware
• A two-tier app that connects directly to a database
• Reviewing local storage, IPC, update integrity, and DLL loading of a desktop app