Thin Client & VDI Penetration Testing
Thin client and VDI penetration testing across Europe: kiosk breakout, session isolation and Citrix, Horizon and AVD tested by OSCP engineers. Fixed quote.
Thin client and VDI penetration testing checks whether a locked-down virtual desktop is actually locked down: can a user break out of the published app, escape the restricted session, steal credentials, or reach the network behind the broker? We test these environments the way a bored insider or a compromised endpoint would, because a VDI is only as strong as the weakest breakout it allows.
Organisations move to virtual desktops to contain risk: keep data in the datacentre, hand users a stripped-down endpoint, control everything centrally. It is a sound model that fails quietly when the lockdown has gaps. A single file dialog, an unfiltered browser, or a misconfigured redirection can turn a kiosk into a shell, and from there into a foothold on the corporate network. That gap is what we hunt for.
What thin client and VDI penetration testing covers
We test from the seat of a legitimate but hostile user. The starting position is the published desktop or application on a thin client, and the objectives are the ones a real attacker cares about: escape the restrictions, escalate privilege, capture credentials, and pivot off the session host into the wider environment.
How we test a VDI environment
We test the platforms European enterprises actually run: Citrix Virtual Apps and Desktops, VMware Horizon, Microsoft Azure Virtual Desktop and Windows 365, along with the thin-client operating systems that connect to them such as IGEL OS, Dell Wyse ThinOS and Stratodesk. The method mirrors how an attacker escalates from a constrained session to the crown jewels.
Establishing the starting position
You give us access as a standard user would have it: the thin client or software client, credentials for a low-privilege account, and the published resources they see. From there we behave as a user who wants out of the box, not one who follows the rules.
Breakout testing
The core of the engagement. We attack every path out of the restricted environment: file open and save dialogs that expose the filesystem, help menus and hyperlinks that spawn a browser, browsers that reach the local shell, and any application feature that can launch another process. Lockdown built with group policy and application control looks complete until one overlooked dialog hands over cmd.exe.
Application control bypass
Where AppLocker or Windows Defender Application Control is meant to stop unauthorised binaries, we test the known bypass techniques: trusted living-off-the-land binaries, script hosts, and misconfigured rules that allow execution from writable paths. Application whitelisting is strong when tight and near-useless when it has holes, and we show which you have.
Privilege escalation and host security
Once we have a shell in the session, we test whether a standard user can become an administrator on the session host through unquoted service paths, weak permissions, vulnerable drivers or missing patches. On shared multi-session hosts this is critical, because local admin can mean access to every other user’s session.
Redirection and data exfiltration
VDI is often deployed specifically to stop data leaving. We test whether clipboard, mapped-drive, USB and print redirection can be abused to move data out, and whether those channels open a route back in. The controls are frequently looser than the data-loss policy assumes.
Broker, gateway and network
We assess the connection broker and gateway, the delivery protocols, and what the session host can reach on the network. A session host that can talk freely to domain controllers, databases and management interfaces turns a desktop breakout into a full internal compromise, and segmentation around VDI is often an afterthought.
Common weaknesses we find
Virtual desktop deployments tend to fail in a predictable handful of ways, nearly all of them configuration rather than platform bugs.
Incomplete lockdown
The most common finding: a restricted desktop or published app with one working escape to Explorer, a command prompt or PowerShell. Users are not supposed to have a shell, and then they do.
Weak segmentation from the session host
Session hosts placed where they can reach far more of the network than their role needs. Break out of one desktop and the internal network is wide open, because nobody segmented the VDI tier.
Credential exposure
Passwords cached in memory and recoverable, saved credentials on the thin client, and single sign-on tokens that can be replayed. A breakout that also yields another user’s or an admin’s credentials is a far worse day.
Loose redirection policy
Clipboard and drive mapping enabled by default when the whole point of the deployment was to keep data inside. These channels are both an exfiltration route and, sometimes, an ingress path for tooling.
Unpatched or misconfigured components
Outdated Citrix, Horizon or gateway components with known vulnerabilities, and thin-client firmware that has not been updated in years. The platform vendors ship fixes; deployments do not always apply them.
Tools and how we work
The testing is manual and creative, because breakout is about finding the one path the hardening missed. We use standard Windows tooling turned to offensive use, PowerShell and living-off-the-land binaries, privilege-escalation checks such as WinPEAS, credential tooling like Mimikatz where in scope, and network tools once we reach the internal environment. On the thin-client hardware we examine the local OS and any stored configuration. Everything is done against your real build, because a finding only counts if it works on the image you actually deploy.
Want this tested on your own systems?
Free 20-minute scoping call, a fixed price with no hourly surprises, and a free retest once you fix what we find.
What you get
The deliverables tell your desktop and infrastructure teams exactly what to fix, in the order that matters.
- An executive summary framing the breakout and pivot risk for management.
- A technical report with each finding scored by CVSS, the exact breakout path reproduced step by step, and a configuration-level fix.
- Findings prioritised so full breakouts and privilege escalations come before minor hardening gaps.
- A remediation call with the reviewing engineer and a free retest once you have hardened the build.
- An attestation letter mapped to the framework you report against where you need one.
Compliance and standards
VDI is frequently the control that keeps regulated data inside a boundary, so testing it supports several frameworks. ISO 27001:2022 control A.8.22 covers network segregation and A.8.5 covers secure authentication, both central to a virtual desktop. If cardholder data is accessed through the VDI, PCI DSS scope and segmentation apply. We also test against the relevant CIS Benchmarks for Windows and the platform, and map the report and attestation to whichever obligation you answer to.
From a locked kiosk to the domain, step by step
The value of this test is clearest as a walkthrough, because each step looks minor until you see where they lead. We start in a published application with no visible way out. A print or save dialog exposes a file browser. From the file browser we reach an executable the lockdown forgot to block, and suddenly there is a command prompt that should not exist.
From a shell to local admin
A shell as a standard user is a foothold, not the finish. We then look for a way to become administrator on the session host, through a weak service permission, an unquoted path, a vulnerable driver or a missing patch. On a shared multi-session host, local admin can mean access to every other user’s live session and their credentials.
From the host into the network
With control of the session host we test what it can reach. Too often the VDI tier can talk freely to domain controllers, file servers and management interfaces, so a desktop breakout becomes a route to the whole environment. Showing this full chain is what turns “the lockdown has a gap” into a risk leadership will fund fixing.
It is almost always configuration, not the platform
Citrix, Horizon and Azure Virtual Desktop can all be locked down tightly. When we break out, the cause is nearly always a configuration gap rather than a flaw in the product: a policy that was not applied to every image, an application feature nobody realised could launch a process, or redirection left at its permissive default. That is good news, because it means the fixes are within your control and the free retest can confirm each one.
Pricing
The thin client vdi penetration testing cost depends on how many platforms and images are in scope, whether shared multi-session hosts are involved, and how far you want us to pivot once we break out.
| Engagement | What’s included | Timeline | Price |
|---|---|---|---|
| Single build | One VDI platform and image, breakout and application-control testing, host privilege escalation, redirection review, report and free retest | 3–5 working days | from €3,000 |
| Standard | Multiple images or platforms, shared session hosts, broker and gateway, credential testing, network pivot, exec + technical report | 5–9 working days | €4,500–€10,000 |
| Advanced | Complex estate, several platforms and thin-client hardware, full segmentation testing, attack-chaining from kiosk to domain | 9–14 working days | €10,000–€20,000 |
| Compliance add-on | Mapping and attestation letter for ISO 27001, PCI DSS or SOC 2 | with any tier | from €800 |
| Custom / large estate | Enterprise VDI across sites and business units, scoped to your needs | on scoping | custom |
Every engagement is fixed-price, quoted after a free 20-minute scoping call — no hourly surprises, and a retest is included. Get a fixed quote
FAQ
How much does thin client and VDI penetration testing cost?
Which VDI platforms do you test?
What exactly is a breakout?
Do you test whether we can pivot into the network?
Will the testing disrupt other users?
Do you check data-loss controls like clipboard and drive redirection?
What will you actually deliver?
Does this support ISO 27001 or PCI DSS?
Related services
Enterprises running Citrix, Horizon or Azure Virtual Desktop to contain sensitive data, teams deploying thin clients and kiosks where users should never reach the underlying OS, and organisations whose auditors expect the virtual desktop boundary to be proven. We are a European offensive-security team working with clients EU-wide and remotely.
Security you can prove
The same standard on every engagement, big or small.
Evidence, not opinions
Every finding ships with a reproduction and proof of concept — no vague "maybe vulnerable".
Humans over scanners
Certified engineers find the logic flaws and chained attacks automated tools walk straight past.
Fixed price, free retest
You know the cost up front, and verifying the fix is part of the deal — not a second invoice.
Ready to lock this down?
Free scoping call, fixed price, free retest. Tell us what you're running and we'll take it from there — usually within one business day.
Tell us what you're running
Scoping is free. We reply within one business day, and under 30 minutes for active incidents.