--- title: "Desktop & Thick-Client Penetration Testing | Mr Cyber" url: https://mr-cyber.com/services/desktop-application-penetration-testing language: en description: "Manual pentests for Windows, macOS and Linux desktop apps and thick clients, including the server they talk to. Fixed price in seconds in the price calculator." --- # Desktop application penetration testing A desktop application penetration test checks whether an installed program, such as a thick client, an agent or an Electron app, can be misused to reach data or rights it should protect. Mr Cyber tests the client, its local data, its updates and the server or API behind it, by hand, at a fixed price, with a free retest. Fixed price **from €3,800** · 4 test days · retest included [See my fixed price](https://mr-cyber.com/quote?service=desktop) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) The client installs whatever update it downloads, without checking the signature. - **4–8 test days**4 test days in the starting price - **OWASP ASVS**\+ 4 more standards - **Report + debrief**within 5 business days - **Free retest**within 60 days ## Who it’s for - Software vendors whose customers install the product on their own machines - Companies running business-critical thick clients, for example ERP, banking or medical software - Vendors whose enterprise customers ask for a pentest report before rollout - Teams preparing for ISO 27001, TISAX, NIS2 or a customer audit ## What we test ### Login & licensing - Login, sessions and role checks - Licence and feature checks in the client - Credentials stored in the application ### Local data & files - Configuration, caches and logs on disk - Local databases and stored secrets - File and folder permissions after installation ### Client to server - Communication with the server or API - Authorisation enforced on the server side - Direct database connections from the client ### Installation & updates - Installer and update process - Rights the application needs to run - Services and helper processes it installs ### Integration with the operating system - Interfaces to other programs on the same machine - Embedded web components, for example in Electron apps ## How we test your desktop app. Five phases, one tester. The same senior tester from first scope to retest. test days in the starting price 4 business days to the report 5 days for the free retest 60 Typically 4–8 testing days, depending on the client, the server side and the number of roles. 1. Phase 1 ### Scope & start date Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing. You pick the date 2. Phase 2 ### Client analysis Installer, local files and network traffic examined. Test day 1 3. Phase 3 ### Client + server testing Local rights, stored secrets and server calls tested. From test day 2 4. Phase 4 ### Report & debrief Audit-ready report and ticket file, then a call. Within 5 business days 5. Phase 5 ### Free retest Your fixes tested again and confirmed in writing. Within 60 days ## Methodology & standards - OWASP ASVS - OWASP WSTG (server and web components) - PTES - NIST SP 800-115 - CVSS 3.1 ## How we test desktop applications We install and use the application like your customers do, then map what it stores locally, which rights it runs with and how it talks to its server. Each area is checked by hand, with the [OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/) as the checklist for the controls that apply. ### Client and server in one test A thick client is only as secure as the server behind it. When the server or API is in scope, we test both with the same accounts, so findings show the complete path from the desktop to your data. ### Critical findings don’t wait for the report If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing. ### Scoring you can act on Each finding gets a **CVSS 3.1** base score (CVSS 4.0 on request) and a business-risk rating that reflects how your customers use the software. ## What you get - Executive summary for management and auditors - Every finding with reproduction steps, evidence and fix guidance - CVSS 3.1 scoring plus business-risk rating and remediation priorities - Debrief call with your developers - Free retest and updated report ### Always included - Free retest within 60 days - Debrief call with your team - NDA, DPA and testing authorisation with the offer - Critical findings reported the same day - Testing stops at any time on your call - Audit-ready report (PDF) - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 Pentest report · Admin & Söhne GmbH · MC-2026-018 Risk: Critical CVSS 3.1 · 9.6 Open · retest included ### Ordering program installs updates that anyone can replace AS-Bestellung for Windows (installed at about 300 dealers) · updates.admin-soehne.example CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H #### Description Admin & Söhne gives its dealers a Windows ordering program. The program fetches its updates from a cloud storage folder that anyone on the internet can write to, and it installs what it finds there without checking the vendor’s signature. A stranger can swap the update file, and every dealer who clicks “Install update” runs the stranger’s program. #### Steps to reproduce 1. Note where the program looks for updates. 2. Check the storage settings with the client’s admin: files can be uploaded without any login. 3. On an isolated test PC, offer a harmless unsigned test package: it is installed after the usual “Install update” click. ``` Update source: updates.admin-soehne.example (cloud storage) Upload allowed without login: yes Signature check before install: none Harmless test package (test PC only) → installed after "Install update" ``` #### Business impact One swapped file reaches all dealer PCs at once: a classic start for ransomware across your whole dealer network, as in the 3CX and Kaseya cases. Your dealers stop selling, and you carry the responsibility. Under NIS2 and the Cyber Resilience Act, secure updates are a duty for software vendors. #### Remediation Close write access to the update storage today and check which files were changed. Sign every update and make the program refuse anything without a valid signature from you. Load updates only over HTTPS, and keep the signing key offline or in a hardware module. CWE-494 (Download of Code Without Integrity Check) · CWE-732 (Incorrect Permission Assignment for Critical Resource) · OWASP Top 10 2021: A08 Software and Data Integrity Failures · MITRE ATT&CK T1195.002 (Compromise Software Supply Chain) ## Fixed price from [€3,800](https://mr-cyber.com/quote?service=desktop) 4 test days · report in 5 business days · retest included Services exclusively for businesses. · [What drives the price](https://mr-cyber.com/pricing) ## Frequently asked questions How much does a desktop application pentest cost? Fixed prices start at €3,800 for one client on one operating system with one or two roles. The server or API, more roles or more operating systems add effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. What do you need from us? The installer or a prepared test machine, test accounts for each role, access to a test server and a contact for emergencies. Documentation helps, source code is optional. Do you test on our machines or yours? Usually on our own test system with your installer. If the software only runs in your environment, a virtual machine or remote access you provide works too. Is the server part of the test? It should be. Many thick clients rely on checks the server never repeats. We test the client and the server together, so you see whether the server enforces the rules itself. How is this different from a malware or vulnerability scan? A scanner looks for known issues in files and libraries. A pentest checks how the application behaves when someone uses it in ways it was not meant for, for example a normal user reaching admin functions.