Thick Client Applications

Directory map

• Thick Client — Discovery & Enumeration — application identification, metadata extraction, dependency analysis, configuration file discovery, backend communication identification
• Attacking Thick Client Applications — hardcoded credentials extraction, DLL hijacking, insecure storage exploitation, network MITM, case study credential extraction, GDB/PEDA ELF connection-string extraction, dnSpy DLL connection-string extraction
• Exploiting Web Vulnerabilities in Thick-Client Applications — SQL injection, path traversal, JAR modification, signature bypass, privilege escalation

Summary

Thick client applications are locally installed software that perform significant processing on the client side, with dependencies on backend servers or databases. Unlike web applications, they execute with the user’s privileges and have direct access to local file systems, registry, and network.

Characteristics:

• Locally installed — Execute with user privileges
• Process independently — Don’t require web browser
• Complex attack surface — Multiple exploitation vectors
• Often unpatched — Enterprise deployments lag security updates
• Legacy technologies — Built with outdated frameworks/patterns
• Credentials locally stored — Hardcoded or insecurely cached

Common frameworks:

• .NET (Windows-focused)
• Java (cross-platform)
• C/C++ (performance-critical, system-level access)
• Python (compiled to .exe)
• Silverlight (legacy, deprecated)

Vulnerability landscape:

• Hardcoded credentials — Passwords in source code (CRITICAL)
• Improper error handling — Stack traces reveal system information
• DLL hijacking — Load attacker-controlled DLLs for code execution
• Buffer overflow — Memory corruption leading to RCE
• SQL injection — Direct database access via unvalidated queries
• Insecure storage — Plaintext or weakly encrypted local data
• Weak session management — Predictable tokens, session fixation
• Unencrypted communication — MITM attacks for credential theft

Architecture patterns:

1. Two-tier: Client ↔ Database (direct)

   • Higher risk: Database credentials in client
   • Attacker can connect directly to database

2. Three-tier: Client ↔ Application Server ↔ Database

   • Better security: Database protected by application server
   • Still vulnerable if application server is compromised

Common scenarios:

• Enterprise project management / CRM systems
• Inventory management applications
• Financial/banking software
• Manufacturing control systems
• System administration tools
• Custom business applications

Post-exploitation value:

• Access to backend databases
• Extraction of system credentials
• Pivot point for network lateral movement
• Information for further social engineering
• Access to production systems (if application integrates)