How much does thick client penetration testing cost in Singapore?

Most thick client assessments in Singapore range from SGD 6,000 for a single desktop application to SGD 25,000+ for multi-application estates with backend integration testing. Price depends on the number of binaries, technology stack, and whether server-side components are in scope.

Do you need our source code for a thick client pentest?

No. We work from the compiled binaries your users install. Decompilation, disassembly, and runtime instrumentation give us everything needed. If source code is available, white box testing can extend coverage, but it is optional, not required.

Can you test .NET and Java applications?

Yes. We decompile .NET assemblies and Java archives back to readable code, inspect managed memory, and test the application the same way an attacker would, regardless of whether it is built in C#, Java, C++, or a mixed stack.

Will the testing help with MAS TRM compliance?

Yes. MAS TRM expects technology risk to be assessed across the full application estate, including internal desktop and trading applications, not just internet-facing systems. Our reports are structured for auditor and regulator review and are delivered by CREST-certified consultants.

Will testing damage our production systems or licence servers?

No. Testing is performed on isolated workstations and controlled copies of the application. We coordinate any tests that touch licence or update infrastructure, and exploitation is validated safely before any finding is confirmed.

DESKTOP APPLICATION PENTEST

Thick Client Penetration Testing

Desktop apps hold a false sense of safety. They sit behind the firewall, so nobody tests them. Attackers start there anyway. We take your Windows, Java, and .NET applications apart the way a real adversary would.

What Is Thick Client Penetration Testing?

Thick client penetration testing examines the security of applications installed and executed directly on a user's workstation: Windows executables, Java applications, .NET assemblies, Electron apps, and any client that holds logic, credentials, or data locally.

Unlike a web application, the code ships to the attacker's machine. Decompilers, debuggers, and memory tools make every hardcoded secret and every client-side trust decision readable. Our CREST-certified consultants test the binary, the runtime, the local storage, and the server-side trust the client relies on.

What We Test

Every layer the attacker can reach from the workstation.

Binary, Java, and .NET Analysis

Decompilation of .NET assemblies, reverse engineering of Java archives, and disassembly of native C/C++ binaries. Hardcoded credentials, API keys, encryption keys, and insecure code paths. We read the code that was supposed to stay compiled.

Memory Inspection

Runtime memory dumping and analysis. Credentials in memory, sensitive data held in plaintext after "secure storage", session tokens recoverable from process space, and keys that survive logout.

Licence and Dongle Checks

Licence validation logic, hardware dongle enforcement, and feature-gating controls. We test whether protections hold against a determined user or whether the check is a speed bump.

DLL Hijacking

Binary planting, DLL search-order exploitation, sideloading, and insecure dependency loading. A single writable directory in the search path can hand a local attacker code execution in your application's security context.

Privilege Escalation

Weak service permissions, insecure registry and file ACLs, unquoted service paths, and local privilege escalation paths through the application. We chain local flaws into domain-level impact.

Update Mechanisms

Update transport security, signature verification, and downgrade attacks. A compromised update channel turns your own installer into the attack delivery mechanism.

Methodology

A C-SARP-style approach, four phases, every engagement.

Reconnaissance

Application inventory, technology stack identification, dependency analysis, file system and registry footprint, and backend endpoint discovery.

Identification

Static analysis through decompilation and disassembly, dynamic analysis under debuggers and instrumentation, memory inspection, and traffic interception between client and server.

Exploitation

Controlled exploitation of confirmed findings: authentication bypass, licence circumvention, DLL hijacking, privilege escalation, and demonstration of real business impact.

Reporting

Detailed findings with reproduction steps, risk ratings mapped to OWASP and CWE, and remediation guidance. Executive summary for management, technical depth for your developers.

Why Financial Institutions Need This

MAS TRM does not stop at the browser.

MAS TRM Alignment

Banks, insurers, and payment institutions run trading terminals, reconciliation tools, and internal desktop applications that handle regulated data. MAS TRM expects technology risk controls across the estate, not only on internet-facing systems. A thick client assessment gives you the evidence.

Reports built for: Auditor review, regulator queries, internal risk committees.

CREST-Certified Consultants

Every engagement is delivered by CREST-certified consultants using a documented, repeatable methodology. Bravix Infosecurity is CSRO-licensed under Singapore's Part 5 Cybersecurity Act.

Why it matters: Third-party and regulator assurance requirements increasingly name CREST accreditation.

Server-Side Trust Testing

Most thick client flaws come from the server trusting the client. We test the backend authorisation and validation with the same rigour as the binary, because fixing the client alone never fixes the vulnerability.

Scope: Optional backend API testing alongside the client assessment.

Request a Thick Client Pentest

Tell us about your application. We'll scope the engagement and send a quote within 48 hours.

Get in Touch