Skip to content

Desktop application penetration testing

A desktop application penetration test checks whether an installed program, such as a thick client, an agent or an Electron app, can be misused to reach data or rights it should protect. Mr Cyber tests the client, its local data, its updates and the server or API behind it, by hand, at a fixed price, with a free retest.

Fixed price from €3,800 · 4 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Admin & Söhne Client Update 4.2 available Install now Update server update-4.2.bin downloaded HTTPS Signature: not checked
The client installs whatever update it downloads, without checking the signature.
  • 4–8 test days4 test days in the starting price
  • OWASP ASVS+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Software vendors whose customers install the product on their own machines
  • Companies running business-critical thick clients, for example ERP, banking or medical software
  • Vendors whose enterprise customers ask for a pentest report before rollout
  • Teams preparing for ISO 27001, TISAX, NIS2 or a customer audit

What we test

Login & licensing

  • Login, sessions and role checks
  • Licence and feature checks in the client
  • Credentials stored in the application

Local data & files

  • Configuration, caches and logs on disk
  • Local databases and stored secrets
  • File and folder permissions after installation

Client to server

  • Communication with the server or API
  • Authorisation enforced on the server side
  • Direct database connections from the client

Installation & updates

  • Installer and update process
  • Rights the application needs to run
  • Services and helper processes it installs

Integration with the operating system

  • Interfaces to other programs on the same machine
  • Embedded web components, for example in Electron apps
See my fixed price

Prefer to talk first? Book a call

How we test your desktop app. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
4
business days to the report
5
days for the free retest
60

Typically 4–8 testing days, depending on the client, the server side and the number of roles.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Client analysis

    Installer, local files and network traffic examined.

    Test day 1

  3. Phase 3

    Client + server testing

    Local rights, stored secrets and server calls tested.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • OWASP ASVS
  • OWASP WSTG (server and web components)
  • PTES
  • NIST SP 800-115
  • CVSS 3.1

How we test desktop applications

We install and use the application like your customers do, then map what it stores locally, which rights it runs with and how it talks to its server. Each area is checked by hand, with the OWASP Application Security Verification Standard (ASVS) as the checklist for the controls that apply.

Client and server in one test

A thick client is only as secure as the server behind it. When the server or API is in scope, we test both with the same accounts, so findings show the complete path from the desktop to your data.

Critical findings don’t wait for the report

If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing.

Scoring you can act on

Each finding gets a CVSS 3.1 base score (CVSS 4.0 on request) and a business-risk rating that reflects how your customers use the software.

What you get

  • Executive summary for management and auditors
  • Every finding with reproduction steps, evidence and fix guidance
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your developers
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-018
Risk: Critical CVSS 3.1 · 9.6 Open · retest included

Ordering program installs updates that anyone can replace

AS-Bestellung for Windows (installed at about 300 dealers) · updates.admin-soehne.example

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

Admin & Söhne gives its dealers a Windows ordering program. The program fetches its updates from a cloud storage folder that anyone on the internet can write to, and it installs what it finds there without checking the vendor’s signature. A stranger can swap the update file, and every dealer who clicks “Install update” runs the stranger’s program.

Steps to reproduce

  1. Note where the program looks for updates.
  2. Check the storage settings with the client’s admin: files can be uploaded without any login.
  3. On an isolated test PC, offer a harmless unsigned test package: it is installed after the usual “Install update” click.
Update source: updates.admin-soehne.example (cloud storage)
Upload allowed without login: yes
Signature check before install: none
Harmless test package (test PC only)
  → installed after "Install update"

Business impact

One swapped file reaches all dealer PCs at once: a classic start for ransomware across your whole dealer network, as in the 3CX and Kaseya cases. Your dealers stop selling, and you carry the responsibility. Under NIS2 and the Cyber Resilience Act, secure updates are a duty for software vendors.

Remediation

Close write access to the update storage today and check which files were changed. Sign every update and make the program refuse anything without a valid signature from you. Load updates only over HTTPS, and keep the signing key offline or in a hardware module.

CWE-494 (Download of Code Without Integrity Check) · CWE-732 (Incorrect Permission Assignment for Critical Resource) · OWASP Top 10 2021: A08 Software and Data Integrity Failures · MITRE ATT&CK T1195.002 (Compromise Software Supply Chain)

Fixed price from

€3,800

4 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does a desktop application pentest cost?
Fixed prices start at €3,800 for one client on one operating system with one or two roles. The server or API, more roles or more operating systems add effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
What do you need from us?
The installer or a prepared test machine, test accounts for each role, access to a test server and a contact for emergencies. Documentation helps, source code is optional.
Do you test on our machines or yours?
Usually on our own test system with your installer. If the software only runs in your environment, a virtual machine or remote access you provide works too.
Is the server part of the test?
It should be. Many thick clients rely on checks the server never repeats. We test the client and the server together, so you see whether the server enforces the rules itself.
How is this different from a malware or vulnerability scan?
A scanner looks for known issues in files and libraries. A pentest checks how the application behaves when someone uses it in ways it was not meant for, for example a normal user reaching admin functions.

Related services

NIS2 & Compliance

Desktop app pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call