Beyond Burp & Paros

Most of you in the world of Web Application Security would have heard about Burp, Paros, WebScarab and other proxy tools to intercept the web (HTTP/HTTPS) requests and able to fiddle around with the parameters.

Going beyond the normal web request proxy tools to intercept the request and fiddle around, what tools do we use to intercept Thick Client Applications?

I have come across the tools like

• Echo Mirage
• Holodeck
  
• ITR
• Wpepro

I think they have been useful, but it is really tedious to get in the relevant data for tampering and be successful. These tools are in fact information tanks where in one will need to mine out relevant things for attacks or testing. :)

Thick Client Application Security

This article discusses the top vulnerabilities in a two tier thick client application.

Thick client is defined as an applicationclient that processes data in addition to rendering. An example of thick client application would be a VB.NET or Java Swing application that communicates with a database.

I have generally observed in these types of applications have weak access controls, weak authentication management, information disclosure, improper error handling or application crash.

It is interesting to note that most of the Open Web Application Security Project (OWASP) Top 10 vulnerabilities are as applicable to Thick Client applications as they are to web applications.

Let us map them for simplicity.

Sr	OWASP Top 10 (Web Apps)	Thick Client
1	Unvalidated Input	Unvalidated Input
2	Broken Access Control	Broken Access Control
3	Broken Authentication & Session Management	Weak Authentication & Session Management
4	Cross-Site Scripting Flaws	Not Applicable
5	Buffer Overflows	Buffer Overflows
6	Injection Flaws	Injection Flaws
7	Improper Error Handling	Improper Error Handling
8	Insecure Storage	Insecure Storage
9	Denial of Service	Denial of Service
10	Insecure Configuration Management	Insecure Configuration Management