{"id":23642324,"url":"https://github.com/cybersecurityup/desktop-app-pentest-checklist","last_synced_at":"2026-01-25T12:01:58.773Z","repository":{"id":266676221,"uuid":"898623191","full_name":"CyberSecurityUP/Desktop-App-PenTest-Checklist","owner":"CyberSecurityUP","description":null,"archived":false,"fork":false,"pushed_at":"2024-12-05T13:13:36.000Z","size":7,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-19T14:04:42.803Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CyberSecurityUP.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-12-04T18:14:27.000Z","updated_at":"2024-12-19T18:01:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"0e52fcca-25d8-4e8c-810f-e81cff62f86b","html_url":"https://github.com/CyberSecurityUP/Desktop-App-PenTest-Checklist","commit_stats":null,"previous_names":["cybersecurityup/pentest-desktop-app-checklist"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/CyberSecurityUP/Desktop-App-PenTest-Checklist","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FDesktop-App-PenTest-Checklist","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FDesktop-App-PenTest-Checklist/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FDesktop-App-PenTest-Checklist/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FDesktop-App-PenTest-Checklist/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CyberSecurityUP","download_url":"https://codeload.github.com/CyberSecurityUP/Desktop-App-PenTest-Checklist/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberSecurityUP%2FDesktop-App-PenTest-Checklist/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28752671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-25T10:25:12.305Z","status":"ssl_error","status_checked_at":"2026-01-25T10:25:11.933Z","response_time":113,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-28T10:49:17.988Z","updated_at":"2026-01-25T12:01:58.754Z","avatar_url":"https://github.com/CyberSecurityUP.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"#### **1. Initial Reconnaissance**\n- [ ] Identify the target operating system (Windows, macOS, Linux).\n- [ ] Identify the application architecture (32/64-bit).\n- [ ] Identify the programming language used (e.g., C++, .NET, Java).\n- [ ] List external dependencies (DLLs, libraries, frameworks).\n- [ ] Verify permissions and privileges required for execution.\n- [ ] Inspect public documentation (user manuals, help files, changelogs).\n- [ ] Identify prior versions and known vulnerabilities (CVEs).\n\n#### **2. Reverse Engineering**\n##### **Static Analysis**\n- [ ] Extract and analyze the main binary.\n- [ ] Identify sensitive strings (passwords, APIs, tokens) using **strings** or **Binwalk**.\n- [ ] Identify dependencies with tools like **Dependency Walker** or **Ghidra**.\n- [ ] Review compilation settings (enabled/disabled protections such as ASLR, DEP, SafeSEH).\n- [ ] Decompile binaries using tools like **IDA Pro**, **Ghidra**, or **dnSpy** (.NET).\n- [ ] Extract and analyze embedded resources (icons, images, scripts).\n- [ ] Identify critical functions: authentication, access control, encryption.\n\n##### **Dynamic Analysis**\n- [ ] Debug the application at runtime using tools like **x64dbg**, **WinDbg**, or **OllyDbg**.\n- [ ] Observe control flows (critical functions, loops, system calls).\n- [ ] Monitor network traffic with **Wireshark** or **Fiddler**.\n- [ ] Map runtime events (file access, memory usage, registry keys).\n\n#### **3. Vulnerability Testing**\n##### **Input Validation**\n- [ ] Test input fields with long strings to identify buffer overflow vulnerabilities.\n- [ ] Check how the application handles unexpected inputs (e.g., special characters, invalid encodings).\n- [ ] Perform fuzzing on input fields using tools like **Peach** or **AFL**.\n- [ ] Test for command injection in fields interacting with system commands.\n- [ ] Test for SQL Injection in forms or embedded database queries.\n\n##### **File Handling**\n- [ ] Verify if the application validates file names (path traversal).\n- [ ] Test creating malicious files in monitored directories.\n- [ ] Modify configuration files and observe behavior changes.\n- [ ] Test corrupted or malformed files.\n\n##### **Memory Security**\n- [ ] Inspect sensitive data stored in memory (passwords, API keys).\n- [ ] Use tools like **Mimikatz** or **Volatility** for memory analysis.\n- [ ] Verify protection against buffer overflow (stack canaries, DEP, ASLR).\n\n##### **Authentication and Authorization**\n- [ ] Check if credentials are stored locally.\n- [ ] Verify session persistence mechanisms (cookies, tokens).\n- [ ] Attempt to bypass authentication checks using reverse engineering.\n- [ ] Test privilege escalation locally.\n\n#### **4. Network and Communication**\n- [ ] Capture traffic generated by the application with **Wireshark** or **tcpdump**.\n- [ ] Inspect API or remote service communication with **Burp Suite**.\n- [ ] Verify encrypted communication (TLS, SSL).\n- [ ] Test for sensitive data interception via reverse proxy.\n- [ ] Identify hidden endpoints and exposed routes.\n\n#### **5. Security Bypass**\n- [ ] Test for anti-debugging mechanisms.\n- [ ] Bypass signed DLL validation checks.\n- [ ] Verify code obfuscation and attempt to deobfuscate.\n- [ ] Inspect and disable checksum verifications in binaries.\n\n#### **6. Persistence**\n- [ ] Analyze temporary files and logs created by the application.\n- [ ] Verify registry key usage for storing data on Windows.\n- [ ] Identify sensitive data in local or persistent storage.\n\n#### **7. Privilege Escalation**\n- [ ] Test application behavior when run as an administrator.\n- [ ] Verify file and directory permissions used by the application.\n- [ ] Exploit misconfigurations, such as writable files in protected directories.\n- [ ] Test malicious DLL/process injection.\n\n#### **8. Advanced Exploitation**\n- [ ] Create custom payloads to exploit identified vulnerabilities.\n- [ ] Inject shellcode into application memory.\n- [ ] Explore malicious DLL injection techniques.\n- [ ] Investigate interdependent processes with **ProcMon** and **Process Explorer**.\n\n#### **9. System Protections**\n- [ ] Verify ASLR, DEP, and other protections in the executable.\n- [ ] Test the effectiveness of digital signatures and integrity checks.\n- [ ] Identify sandboxing or security containerization mechanisms.\n\n\n## Windows API for Desktop Application Pentesting\n\n### 1. Interception and Manipulation of Input and Output\n\n#### Relevant APIs\n- `ReadProcessMemory` and `WriteProcessMemory`: To read or modify data directly in the application's memory.\n- `SetWindowsHookEx`: To intercept keyboard or mouse inputs.\n\n#### Example Usage\n- Use `SetWindowsHookEx` to capture keyboard events and simulate interactions with the application.\n- Use `ReadProcessMemory` to access data in memory, such as authentication information or sensitive data.\n\n---\n\n### 2. Automating Interactions with the Application\n\n#### Relevant APIs\n- `SendMessage` and `PostMessage`: To send events to the application's interface.\n- `FindWindow` and `FindWindowEx`: To locate specific windows or controls.\n- `EnumWindows`: To enumerate all open windows and locate the target application.\n\n#### Example Usage\n- Use `FindWindow` to identify the application's main window.\n- Send events using `SendMessage` to fill out login fields and submit the form automatically.\n\n---\n\n### 3. Process Manipulation\n\n#### Relevant APIs\n- `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next`: To enumerate running processes.\n- `OpenProcess`: To open a process with specific permissions.\n- `TerminateProcess`: To terminate processes.\n\n#### Example Usage\n- Enumerate running processes to locate processes related to the application.\n- Use `OpenProcess` to access information or inject code into the application's process.\n\n---\n\n### 4. Reverse Engineering\n\n#### Relevant APIs\n- `VirtualProtectEx`: To modify memory permissions, allowing changes to executing code.\n- `CreateRemoteThread`: To inject threads into the application's processes.\n- `LoadLibrary`: To remotely load custom DLLs.\n\n#### Example Usage\n- Inject a custom DLL into the application to intercept critical functions.\n- Use `VirtualProtectEx` to alter memory protection and modify the behavior of sensitive functions.\n\n---\n\n### 5. Resource Monitoring\n\n#### Relevant APIs\n- `GetFileAttributes` and `ReadFile`: To access and monitor files used by the application.\n- `RegOpenKeyEx` and `RegQueryValueEx`: To inspect registry keys used by the application.\n\n#### Example Usage\n- Monitor configuration files or logs generated by the application to identify security flaws.\n- Examine the Windows registry for configuration or credential information.\n\n---\n\n### 6. Vulnerability Detection\n\n#### Relevant APIs\n- `HeapWalk` and `HeapAlloc`: To interact with the application's heap.\n- `DeviceIoControl`: To interact with drivers and check if the application makes insecure device calls.\n\n#### Example Usage\n- Explore memory allocation flaws (e.g., buffer overflows).\n- Test device control functions to identify improper permissions.\n\n---\n\n### 7. Debugging Instrumentation\n\n#### Relevant APIs\n- `DebugActiveProcess` and `DebugActiveProcessStop`: To attach a debugger to the application.\n- `WaitForDebugEvent`: To capture events generated by the application during runtime.\n\n#### Example Usage\n- Use a debugger to inspect the application's execution flow in real-time.\n- Identify critical parts of the code that can be exploited.\n\n---\n\n### Tools and Recommended Languages\n\n#### Languages\n- **C/C++**: For direct access to Windows APIs.\n- **Python**: Using libraries like `ctypes` or `pywin32`.\n\n#### Tools\n- **x64dbg** or **OllyDbg**: For debugging and memory analysis.\n- **Process Monitor** and **Process Explorer**: For monitoring processes and system events.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcybersecurityup%2Fdesktop-app-pentest-checklist","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcybersecurityup%2Fdesktop-app-pentest-checklist","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcybersecurityup%2Fdesktop-app-pentest-checklist/lists"}