Overview
Two-tier desktop software is still everywhere in Indian broking houses, cooperative banks, hospitals and manufacturing ERP rollouts. These clients frequently talk straight to a database or an internal service and keep credentials on the local disk. We examine the binary, its configuration files, its network traffic and the server it trusts, and we write findings so that the software vendor can act on them when the code belongs to someone else.
A thick client puts code and often credentials on the user's own machine, which changes the threat model entirely. We start on the host, inspecting how the application stores configuration, connection strings, tokens and cached data, and whether a standard user can read secrets, tamper with files or escalate privileges through weak permissions, services or installers.
We then turn to the binary and the wire. Reverse engineering reveals hard-coded secrets, hidden functionality and weak cryptography, while runtime analysis shows how the application behaves when its inputs and memory are manipulated. For two-tier designs that connect directly to a database, we test whether the client's trust can be abused to run queries or reach data the user should never touch; for three-tier designs we test the service in between.
The goal is to show what an insider or a compromised endpoint can actually achieve, not to list theoretical weaknesses. Every finding is reproduced, scored with CVSS v4.0, and paired with a fix aimed at the right layer, whether that means moving trust to the server, tightening file permissions, or removing secrets from the client. Critical issues are reported as soon as we confirm them.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Environment setupWe install the client with test accounts and map its architecture and dependencies.
- Host reviewWe inspect local storage, permissions and privilege paths on the machine.
- Binary & runtimeWe reverse engineer and instrument the binary to observe its real behaviour.
- Traffic testingConnections to databases and services are intercepted, replayed and manipulated.
- Report & debriefFindings are evidenced, scored and explained to your application owners.
What you receive
- Architecture summary with identified trust boundaries
- Risk-rated findings with reproduction evidence
- CVSS v4.0 scores and layer-specific remediation
- Analysis of client-side versus server-side enforcement
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP ASVS
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- CVSS v4.0
- CWE
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
What do you need to test a thick client?
An installer or build, test accounts for each role, and a test instance of any database or service it connects to. If the application only runs against production data, we agree safe limits in writing and favour non-destructive techniques throughout.
Can you test an old application you do not have source for?
Yes. Legacy clients are common and we routinely test compiled binaries without source. Reverse engineering, host inspection and traffic analysis let us assess an application whose developers have long since moved on.
Why test the database connection?
Two-tier applications often trust the client to behave, which means a user who can read the connection string or craft their own queries may reach data the interface never shows. Testing that path reveals whether real enforcement lives on the server or only in the client.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.