cheatsheets/checklists/fatclient-audit.md

---

title: Fat-Client Audit Checklist date: 2021-01-13 categories: [checklists]

tags: [fatclient, audit]

Fat-Client Audit Checklist

Cryptography: Authentication & Encryption

• Is the traffic encrypted?
• Insecure Crypto Algorithms?
• Replay attacks possible?
• Forward Secrecy?
• Key Control? (Is one party alone responsible for the final session key?)
• HTTPS: Certificate Pinning?
• Message Authentication (HMAC?)
• Authentication only on the client side?
• Change privileges by impersonating a different user
• Able to change the permissions client side?
• MitM Application (Burp, CANAPE, ...)

Implementation

• Language: C#, Java, C/C++?
• Native Implementation: Memory Corruptions
• Native Implementation: Unsafe functions (memcpy, strcpy)
• DEP, ASLR enabled?
• Hardcoded Credentials
• Obfuscated code?
• PDB Files with symbols?
• Sensitive Information in the binary? (Developer Paths, ..)
• Elevation of Privileges?
• Authent. Logic on the client or server?
• Debugging the application
• Error Messages with too much information
• Outdated libraries?
• Deserialization Vulnerabilities

Business Logic

• Proper separation of access rights
• Bypass client-side validations

Configuration

• Hardcoded Credentials
• Encrypted Configuration Files?
• Other sensitive Information?
• Change application settings (E.g. Developer Mode)

Useful Tools

• Dissassembler: IDA Pro, Cutter, Ghidra, dnSpy, ...
• Debugger: r2, x64, ...
• Proxy: Burp Suite, CANAPE, Postman (APIs)
• Sysinternals: Process Explorer, Process Monitor, strings, ...
• API Monitor
• Frida (+ Fermion GUI)

Further Tipps/Hints:

• Procmon for president:
  • Check for network endpoints (disable DNS resolving)
  • Check loaded configuration files
  • Check if files are loaded from shares
  • Check for missing DLLs for DLL Load Order Hijacking (if proc. is elvated)
• Introspect socket content with API Monitor and backtrace syscalls to the original DLL/Executable
• View all loaded DLLs with Process Explorer (Ctr+D)
• If openSSL is used: hook the SSL_write and SSL_read functions to read the plaintext traffic.
• DnSpy can export all loaded modules of a (.Net) application as VS project