Home / Services / Desktop & thick-client VAPT

Desktop & thick-client VAPT

Desktop & thick-client testing Windows, macOS, Linux.

.NET WinForms / WPF, Electron, Qt, Java desktop. Reverse engineering, IPC, local privilege, secret storage — the class of app UK industry still ships.

Thick-client work is still a UK problem: the binary, the IPC, the server behind it.
Thick-client work is still a UK problem: the binary, the IPC, the server behind it.

Coverage

Still a UK problem in 2026

Reverse engineering

Unpack, decompile, recover hidden admin, licence checks, and the API key in the binary.

dnSpyGhidra

IPC & local privilege

Named pipes, COM, insecure services, DLL search order, installer repair tricks.

IPCLPE

Secret storage

Config files, DPAPI misuse, hardcoded connection strings, update channels you do not pin.

SecretsUpdates

The server behind it

Thick clients are still clients. We test the protocol they speak with the same two-account discipline.

ProtocolAuthz

If finance still runs a .NET client, that is in scope. Bring the installer, a test licence, and written authorisation.

Ready to scope a UK engagement?

A thirty-minute call. Assets, timeline, a quote in pounds sterling.

Request a quote