Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introduction to Hacking Thick Clients: Part 1 – the GUI

netspi.com | blog | #windows | #tooling | #pentest | #thick-client | #winforms | #wpf | #gui

Summary

Part one of the thick client series covers GUI testing for Windows Forms and WPF apps, using WinSpy, Window Detective, and Snoop to reveal masked passwords and bypass client-side checks.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Introducing BetaFast – NetSPI's Vulnerable Thick Client
NetSPI releases BetaFast and Beta Bank, two deliberately vulnerable C# thick clients for practice, with flaws from SQL injection and hardcoded credentials to unencrypted database connections.
blog · netspi.com
Gaining AWS Console Access via API Keys
Converts compromised AWS API keys, whether permanent AKIA or temporary ASIA credentials, into browser console access via the federation endpoint, easing recon compared with wrangling CLI syntax.
blog · netspi.com
Automating Managed Identity Token Extraction in Azure Container Registries
NetSPI shows how malicious Azure Container Registry tasks can generate and export tokens for attached Managed Identities, releasing a MicroBurst tool, Invoke-AzACRTokenGenerator, to automate it.
blog · netspi.com
Burp Suite Extension: AWS Signer 2.0 Release
AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.
blog · netspi.com
NetblockTool: The Easy Way to Find IP Addresses Owned by a Company
NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.
blog · netspi.com
AutoDirbuster – Automatically Run and Save DirBuster Scans for Multiple IPs
AutoDirbuster wraps OWASP DirBuster in Python to run directory brute-forcing across multiple IP:port targets automatically, accepting Nmap gnmap files and saving per-target reports.
back