Hey all. Today, we will learn about source code review of our thick client application. For that, we will use visual code grepper. We can download that from: https://sourceforge.net/projects/visualcodegrepp/ Or from here: https://github.com/nccgroup/VCG Just install and let’s open that. …

Hey all. Today, we will check any sensitive string by dumping the memory of our thick client application. We will also see SQL injection into our application. Now, checking any sensitive string by dumping memory will only possible if our thick client application uses encrypted/non-encrypted hard-coded connection string. Now we…

Hey all. Today we will learn DLL Injection. What is DLL? A Dynamic Link Library or DLL is a kind of instruction file which can be used by any application. Suppose you have two application in your machine. One application has DLL “A”. Now the second application can also use…

Hey all. Today we will learn about regshot. Basically to compare the difference between registry changes in our machine before and after the login into our thick client application. We can download the regshot from here: https://github.com/Seabreg/Regshot Before that lets login into our thick application as rebecca and add some…

Hey all. Today we will use the strings and sigcheck. All these are available in sysinternal tools. So, let’s open the sigcheck with our DVTA, and we can see that it is showing it is unsigned. Now, above that is a vulnerability. Any application which is a production level or which is in market for customers to use that should be verified by their organization. That shows it is a genuine product. Let’s use strings on our application and save in a text file.

Hey all. Let’s first download all necessary tools. Maximum tools can be found on sysinternal tools, which is from Microsoft. We can download from here: https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite First we need to see what type of our thick client application is. like what language is used to made that and all. For…

Hey all. Previously we have done the lab setup. But we actually don't know we are able to log in or not. Moreover, this DVTA is a 2-tier thick client application, its database is in our machine only. …

Hey all. Now we need a fresh Windows 10. I did in the virtual box. We need to install some applications like Microsoft SQL server and Microsoft SQL Management studio. I installed the current latest version which 2022. Microsoft SQL server: SQL Server Downloads | Microsoft Microsoft SQL Management Studio: Download…

Hey all. From today onwards, we will learn Thick Client. To learn we will use the DVTA which is a vulnerable machine for learning and practice thick client VAPT. Now what is Thick client? Thick client is a desktop application. It can work online or offline. Like zoom, slack. It…