ThickClientAllTheThings¶
The desktop-app security reference nobody wrote down, so I did.
Everyone points their tooling at web and mobile. Meanwhile the thick client sitting on someone's machine, with local admin, a signing cert, an auto-updater, an IPC bus, and an entire browser engine bolted inside it, gets a shrug. That's the gap. This is the map for it: how to test Electron, Tauri, CEF/WebView2, .NET, Java, and native desktop apps, organized the way an attacker actually moves through one instead of a web checklist stapled onto a binary.
Methodology, not a weapon. Authorized testing only.
Contents¶
Start at recon (know what you're looking at), then walk the surface. Each book is a deep guide;
CHECKLIST.md is the fast index if you just want the questions.
- Reconnaissance & Unpacking — fingerprint the framework, unpack the app, read what shipped
- Secrets & Data at Rest — hardcoded keys, token storage, secure-storage misuse, logs
- Inter-Process Communication — Electron IPC, named pipes, COM, DBus, local sockets
- Embedded Web Layer — Electron/CEF/WebView2 isolation, and the XSS-to-RCE path
- Update Mechanism — update-channel integrity, signatures, downgrade
- Binary Protections & Tampering — signing, DLL search-order hijack, anti-tamper
- Network & API — TLS pinning, cert validation, client-side trust, local servers
- Runtime, Memory & Instrumentation — Frida, hooking, memory secrets
- Auth, Licensing & Authorization — client-side gates, license bypass, multi-user
- Deep Links & Protocol Handlers — custom URI schemes, argument injection
Framework coverage¶
The techniques are framework-tagged throughout. Quick orientation for where each one bites hardest:
| Framework | Unpack with | Watches hardest |
|---|---|---|
| Electron | asar extract, DevTools |
web layer, IPC, nodeIntegration |
| Tauri | binary + bundled assets | IPC allowlist, the Rust/JS boundary |
| CEF / WebView2 | resource/pak extraction | remote content, message channels |
| .NET (WPF/WinForms) | ILSpy, dnSpy | decompilable IL, config, DPAPI |
| Java (Swing/JavaFX) | CFR, procyon, jd-gui | decompilable bytecode, JAR secrets |
| Native (C/C++, Qt, Delphi) | Ghidra, IDA, strings | memory, DLL hijack, anti-tamper |
How to use it¶
- Fingerprint and unpack first. Everything downstream depends on knowing what you're looking at.
- Walk each book's techniques against your target. Every entry is a question with a concrete way to answer it.
- Record evidence as you go. A finding is a reproducible path from a starting condition to an impact, not a scanner line you pasted in.
- If a control can't be tested safely, say so. "Untested assumption" is honest. A quiet "pass" it didn't earn is not.
Scope and ethics¶
Everything here is for testing software you are authorized to test. Written agreement, defined scope, explicit rules of engagement. Nothing in this repository is a packaged exploit; it is how you find the weak spots and close them.
Author¶
Built and maintained by pa7ch3s, offensive security engineer. A decade of breaking things on purpose, including a fair amount of thick-client work that needed a reference like this and didn't have one. So here it is. Welcome home.