Pentesting thick clients