Penetration Testing
Desktop Application Penetration Test
We test your internal desktop applications on the user's computer and in their communication with the server. We show how the application could be abused through local privileges, stored data or updates.
What it is
Desktop applications are still widely used in branch, treasury and production processes. They often run with local privileges and connect directly to the server. The test examines the client itself, the data it stores and its communication with the server together. Controls enforced only on the client are a typical risk in this type of application.
Scope
- Local permissions on application folders and services
- Passwords and connection details stored in local files, registry and memory
- Encryption and authentication of communication with the server and database
- Whether authorization checks in the client are also enforced on the server
- Signature and source validation in the update mechanism
The need
When organizations need it
- Before desktop software from a supplier is deployed to many users.
- When your procurement rules require software to pass a security test before use.
- When a legacy client-server application is moved to a new network or remote work model.
Method
How we work
-
Setup
We install the application on a test computer configured like your users' machines.
-
Client analysis
We examine file permissions, stored data and application runtime behavior.
-
Communication testing
We examine server traffic and check whether client-side controls are also enforced on the server.
-
Report and retest
We report findings in a form you can share with your supplier and retest the new version.
Outcome
What you have at the end
You know whether the application exposes user computers to privilege escalation, data leakage or fake updates. You have specific fixes to request from the supplier.
Frequently asked questions
The application belongs to a supplier and we have no source code. Is testing possible?
Yes, the test is performed on the distributed application. We review the testing terms in your license agreement together at the start.
Are applications published via Citrix or remote desktop in scope?
The application itself is examined in this test. For the risk of breakout from a restricted session, the VDI, Citrix and Kiosk Breakout Testing service is appropriate.
Penetration Testing
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting