> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/thick-and-thin-client.md). # Thick & Thin Client ### Thick Client A **thick client** (also called a **fat client**) is an application that is **installed on the user's computer** and performs a significant portion of its processing and business logic locally. Although it may communicate with a server, the client itself contains executable code, configuration files, and often stores data locally. #### What is tested? During a thick client penetration test, the assessment focuses on both the **local application** and its **communication with the backend server**. Typical test areas include: * Authentication and authorization * Local file and configuration security * Sensitive data stored on the client * Registry and application settings * Hardcoded credentials or API keys * Binary reverse engineering * Client-side business logic bypass * Network communication and API security * TLS/SSL certificate validation * DLL hijacking * Local database security * Update mechanism security * Input validation and injection vulnerabilities (where applicable) #### Examples * Microsoft Outlook (Desktop) * SQL Server Management Studio (SSMS) * KeePass * PuTTY * Java desktop applications * .NET desktop applications * Electron applications * Custom Windows (.exe) applications *** ### Thin Client A **thin client** is an application architecture where **most of the processing and business logic is performed on a remote server**, while the client primarily provides the user interface and sends user input to the server. The client may be: * A web browser * Citrix Workspace * Microsoft Remote Desktop (RDP) * VMware Horizon * Another lightweight client #### What is tested? The focus is **not the client software itself**, but the **application, session, and server-side functionality** delivered through the thin client. Typical test areas include: * Authentication and authorization * Session management * Business logic flaws * API security * Input validation * SQL Injection (where applicable) * Cross-Site Scripting (XSS) (for web-based thin clients) * Cross-Site Request Forgery (CSRF) (for web-based thin clients) * Server-Side Request Forgery (SSRF) * Insecure Direct Object References (IDOR) * File upload/download vulnerabilities * Clipboard, drive, and printer redirection (Citrix/RDP) * Access restrictions and environment escape * Sensitive data exposure > **Note:** If the thin client is a browser-based application, the penetration test is essentially a **Web Application Penetration Test**. If it is delivered through Citrix, RDP, or VDI, the assessment also includes session controls and remote environment security. #### Examples * Gmail * GitHub * Jira * Banking web portals * SAP is published through Citrix * Applications accessed via Microsoft RDP * VMware Horizon hosted applications *** #### Comparison | Feature | Thick Client | Thin Client | | ------------------------------ | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | Definition | Application installed on the user's computer that performs significant local processing | Application architecture where most processing occurs on a remote server | | Client Installation | Usually installed locally | May be browser-based or a lightweight installed client (e.g., Citrix, RDP) | | Business Logic | Mostly on the client | Mostly on the server | | Local Storage | Common | Minimal or none | | Reverse Engineering | Common | Rare | | Registry/File Analysis | Yes | Usually No | | Binary Security Testing | Yes | No (unless the client itself is in scope) | | Network/API Testing | Yes | Yes | | Authentication & Authorization | Yes | Yes | | Business Logic Testing | Yes | Yes | | Typical Vulnerabilities | Hardcoded secrets, DLL hijacking, insecure local storage, client-side logic flaws | SQL Injection, XSS, CSRF, IDOR, SSRF, session management, access control issues | | Examples | Outlook Desktop, SSMS, KeePass, Java/.NET applications | Web applications, Citrix-hosted apps, RDP applications, VMware Horizon | ### Resources {% embed url="" %} {% embed url="" %}