Introduction to Hacking Thick Clients: Part 2 – The Network

The final installment of the thick client series covers memory analysis: dumping a process from Task Manager, extracting strings, and why sensitive data should use mutable types that can be wiped.

Thick client series part five covers API monitoring and invocation: API Monitor logs over 500,000 calls during login, and .NET SmokeTest lets testers load assemblies and run individual methods.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.

Part three of the thick client series hunts sensitive data in the Windows file system and registry, with tips on focusing tests on installers, login forms, and Remember Me storage.

Part one of the thick client series covers GUI testing for Windows Forms and WPF apps, using WinSpy, Window Detective, and Snoop to reveal masked passwords and bypass client-side checks.

NetSPI releases BetaFast and Beta Bank, two deliberately vulnerable C# thick clients for practice, with flaws from SQL injection and hardcoded credentials to unencrypted database connections.