Name: thick-client
Author: zhaoxuya520

Imported from zhaoxuya520/reverse-skill (skills/thick-client/SKILL.md) via skills.sh. Install upstream with npx skills add zhaoxuya520/reverse-skill --skill thick-client. Copyright stays with the author.

Thick Client Security Testing

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-pentest.md
NOW: 确认目标是 桌面厚客户端（Win/macOS/Linux GUI 或服务伴生），非纯 Web
NOW: case-init；安装包来源与测试账号写入 scope
NEXT: 工具（Burp 上游代理、进程监控、逆向工具）
ACT: 信任边界图 → 本地面 → 网络面 → 更新/供应链

适用场景

C/S 架构客户端、Electron/Qt/.NET WinForms/WPF
本地配置/凭证存储、IPC、命名管道
客户端强制校验绕过研究（授权）
自动更新通道与代码签名验证

工作流

1. 建边界

□ 进程树、子进程、驱动/服务
□ 监听端口与出站域名
□ 本地敏感路径：%APPDATA%、Keychain、注册表

2. 本地攻击面

□ 明文配置、硬编码密钥、调试开关
□ DLL 劫持/搜索顺序（Windows）
□ 数据库文件（SQLite）权限与加密
□ IPC：谁可连接？是否鉴权？

3. 网络面

□ 系统代理 / 应用自定义 TLS
□ 证书钉扎 → 联合 mobile/js 方法学或 Frida
□ API 越权：客户端隐藏的管理接口

4. 逆向验证

□ .NET → dotnet-reverse；原生 → ida/ghidra；Electron → asar + js-reverse

工具链

工具	用途
Process Monitor / API Monitor	行为
Burp / mitmproxy	流量
dnSpy / IDA / Ghidra	逆向
Sysinternals	Windows 面
asar / nexe 检测	Electron

参考

references/thick-client-checklist.md
../dotnet-reverse/ ../ida-reverse/ ../js-reverse/ ../api-security/

路由上下文

上游: MASTER R32
下游: 纯协议 protocol-reverse；供应链更新 supply-chain-security

任务完成自检

是否画出信任边界？
本地+网络面是否都覆盖？
Checklist？

Install thick-client and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "zhaoxuya520-reverse-skill-thick-client", "kind": "skill", "name": "thick-client", "description": "Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.", "publisher": "zhaoxuya520", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/zhaoxuya520/reverse-skill", "path": "skills/thick-client/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/zhaoxuya520/reverse-skill/thick-client", "key": "zhaoxuya520/reverse-skill/skills/thick-client/SKILL.md" } }, "instructions": "# Thick Client Security Testing\n\n## ACTION REQUIRED（读完后立刻执行）\n\n1. `NOW`: 读取 `../field-journal/precedent-pentest.md`\n2. `NOW`: 确认目标是 **桌面厚客户端**（Win/macOS/Linux GUI 或服务伴生），非纯 Web\n3. `NOW`: case-init；安装包来源与测试账号写入 scope\n4. `NEXT`: 工具（Burp 上游代理、进程监控、逆向工具）\n5. `ACT`: 信任边界图 → 本地面 → 网络面 → 更新/供应链\n\n## 适用场景\n\n- C/S 架构客户端、Electron/Qt/.NET WinForms/WPF\n- 本地配置/凭证存储、IPC、命名管道\n- 客户端强制校验绕过研究（授权）\n- 自动更新通道与代码签名验证\n\n## 工作流\n\n### 1. 建边界\n\n```text\n□ 进程树、子进程、驱动/服务\n□ 监听端口与出站域名\n□ 本地敏感路径：%APPDATA%、Keychain、注册表\n```\n\n### 2. 本地攻击面\n\n```text\n□ 明文配置、硬编码密钥、调试开关\n□ DLL 劫持/搜索顺序（Windows）\n□ 数据库文件（SQLite）权限与加密\n□ IPC：谁可连接？是否鉴权？\n```\n\n### 3.", "cost": { "context_tokens": 314 } }

thick-client

About