Threats Test Page Test no.

Configuration files in the client 1

Registry 2

An adversary can access sensitive Application components 3

information because of insecure
application configuration
Client-side application logs 4

Memory (Random Access Memory) 5

6
An adversary can get system
privileges on the Database server
database/application server 7

An adversary can access directories Application server/Database server 8

Unnecessary services are running

on the application server or Command prompt 9
database server.

Unsigned Code Application Level 10

An adversary can enumerate the

database as two-tier architecture is Anywhere in the application 11
in place

Application Level 12

Anywhere in the application 13

Anywhere in the application 14

Anywhere in the application 15

Others
 Anywhere in the application 16

Anywhere in the application 17

Others
Anywhere in the application 18

Anywhere in the application 19

Anywhere in the application 20

Anywhere in the application 21

Note - Risk should be set depending upon the Impact and Likelihood of the attac

Resources - http://resources.infosecinstitute.com/application-sec

Damn Vulnerable Thickclien

http://resources.infosecinstitute.com/practical-thick-client-application-penetr
 Test Name

Check for sensitive information stored in config files in cleartext in the application installed d

Analyze the registries accessed by the application to check for sensitive details like keys, encrypted passwords etc.

Look for sensitive information hard coded in the application source code by using simple tex

Check whether auditing and logging is enabled. If Yes, then look for sensitive data as the u

Check for Database credentials/other sensitive information in memory

Run SQL client and try connecting to the database by using the default username and
password.
Manipulate SQL queries being passed by the client to the server in Echomirage. Replace
existing columns or tables in the current SQL query with those that should not be accessible
to the logged-in user.

Check whether world-writable open shares are present on an application server.

Run a Port Scan on the server. Enumerate all the known services and try to gain access to
the server.

Check whether application is signed

Run Wireshark/echomirage and check whether there is any traffic directed towards the
database.(Check for sql queries in the request)

Binary analysis - Check whether application makes use of common exploit mitigation
techniques

CSV injection

SQL Injection

Session Management
 Authentication

Authorization

Input validations

Password management

Response Modification

DLL Hijacking

nding upon the Impact and Likelihood of the attack. Also the criticality of the Application should be considered.

p://resources.infosecinstitute.com/application-security-testing-of-thick-client-applications/#gref

Damn Vulnerable Thickclient Application

.com/practical-thick-client-application-penetration-testing-using-damn-vulnerable-thick-client-app-part-1/
 Risk Note Reference link Status

Medium http://resources.infosecinstitute.com/practical-thick-clien

High Use Tool Process Monitor of sysinternals http://resources.infosecinstitute.com/application-securit

for the same.
Use any of the following tools for this
High http://resources.infosecinstitute.com/damn-vulnerable-t
activity:
-- Any the
Check simple text editor
reference link for more info http://resources.infosecinstitute.com/damn-vulnerable-t
High

Winhex Tool
Medium http://resources.infosecinstitute.com/damn-vulnerable-t
Process hacker

High

High

High

High

High Use Sigcheck.exe from sysinternals http://resources.infosecinstitute.com/damn-vulnerable-t

This check is to know whether application

High is using 2-tier architecture. If yes then
report.

Medium Use BinScope http://resources.infosecinstitute.com/damn-vulnerable-t

Only possible if data is exported into

High http://resources.infosecinstitute.com/damn-vulnerable-t
spreadsheet

High

High
High

High

High

High

High

Use DLL-Hijack Auditor,Process

High http://resources.infosecinstitute.com/damn-vulnerable-t
monitor(Sysinternals)

Note - DVTA appsec is divided into 10 parts/articles.

Adjoining link is of 1st part. Other links can be found out
through this.