ThickClientGalore¶
This is simply my research and the repo I've always wanted. Notes from everything I could find (WITH my own notes included); made pretty just for you.
This maps: how to test Electron, Tauri, CEF/WebView2, .NET, Java, and native desktop apps, organized the way an attacker would move through one.
For Educational purposes only.¶
Contents¶
Start at recon (know what you're looking at), then walk the surface. Each book is a deep guide;
CHECKLIST.md is the fast index if you just want the questions.
- Reconnaissance & Unpacking — fingerprint the framework, unpack the app, read what shipped
- Secrets & Data at Rest — hardcoded keys, token storage, secure-storage misuse, logs
- Inter-Process Communication — Electron IPC, named pipes, COM, DBus, local sockets
- Embedded Web Layer — Electron/CEF/WebView2 isolation, and the XSS-to-RCE path
- Update Mechanism — update-channel integrity, signatures, downgrade
- Binary Protections & Tampering — signing, DLL search-order hijack, anti-tamper
- Network & API — TLS pinning, cert validation, client-side trust, local servers
- Runtime, Memory & Instrumentation — Frida, hooking, memory secrets
- Auth, Licensing & Authorization — client-side gates, license bypass, multi-user
- Deep Links & Protocol Handlers — custom URI schemes, argument injection
Framework coverage¶
The techniques are framework-tagged throughout. Quick orientation for where each one bites hardest:
| Framework | Unpack with | Watches hardest |
|---|---|---|
| Electron | asar extract, DevTools |
web layer, IPC, nodeIntegration |
| Tauri | binary + bundled assets | IPC allowlist, the Rust/JS boundary |
| CEF / WebView2 | resource/pak extraction | remote content, message channels |
| .NET (WPF/WinForms) | ILSpy, dnSpy | decompilable IL, config, DPAPI |
| Java (Swing/JavaFX) | CFR, procyon, jd-gui | decompilable bytecode, JAR secrets |
| Native (C/C++, Qt, Delphi) | Ghidra, IDA, strings | memory, DLL hijack, anti-tamper |
How to use it¶
- Fingerprint and unpack first. Everything downstream depends on knowing what you're looking at.
- Walk each book's techniques against your target. Every entry is a question with a concrete way to answer it.
- Record evidence as you go. A finding is a reproducible path from a starting condition to an impact, not a scanner line you pasted in.
- If a control can't be tested safely, say so. "Untested assumption" is honest. A quiet "pass" it didn't earn is not.
Scope and ethics¶
Everything here is for testing software you are authorized to test. Written agreement, defined scope, explicit rules of engagement. Nothing in this repository is a packaged exploit; it is how you find the weak spots and close them.
Author¶
Built and maintained by pa7ch3s.