OWASP Desktop App DA7: Test Insecure Communication

The OWASP Desktop App Security Top 10 lists DA7: Insecure Communication for desktop applications. It covers weak TLS or DTLS cipher suites, unencrypted database queries, and protocols such as MQTT and CoAP that carry sensitive data. Most of these never touch HTTP, which is why a web proxy shows nothing.

This guide maps each DA7 check to a concrete step with InterceptSuite.

1. Find out what the app really sends

Run the client through the SOCKS5 listener (use ProxyBridge if the app ignores proxy settings) and open Proxy History. Every connection shows host, port, protocol and ALPN. Group by protocol first:

Plain TCP to a database or service port is a finding on its own if it carries credentials or data.
TLS connections can be decrypted so you can read what is inside.
UDP, DTLS and QUIC traffic is listed alongside, with no extra setup.

2. Look for unencrypted sensitive data

Use the history search with a filter expression, for example:

port == 1433 and data contains "password"

Check connection strings, session tokens, query text and personal data. Unencrypted database queries on the wire are a classic DA7 result: the bytes are readable in the packet viewer and can be exported to PCAP for evidence.

3. Check the TLS and DTLS posture

Confirm the app uses TLS where it should, and note what happens when the certificate is not trusted: does the client refuse the connection, or carry on? A client that accepts an untrusted certificate fails the transport-security check. For apps that pin certificates, use TLS pass-through to leave those hosts untouched while you test the rest. InterceptSuite handles DTLS 1.0 and 1.2 as well as TLS.

4. Message-broker and IoT protocols

DA7 names MQTT and CoAP explicitly. MQTT runs over TCP on port 1883 (plain) or 8883 (TLS). Intercept it and read CONNECT packets for client ID and credentials, then topics and payloads. See Intercepting MQTT Traffic for the full walkthrough. DTLS-based devices are covered in IoT Security Testing.

5. Tamper and replay

A secure channel should also resist modification. Use interception rules to hold only the packets you care about, edit them (including in the hex editor), and forward. Then use Replay to resend a captured request with changes and read the reply. Weak integrity checks and replayable messages show up quickly this way.

6. Record the evidence

Export the capture to PCAP for Wireshark and attach screenshots of the decrypted packets to the report. Use Scope so the history only contains in-scope targets.

DA7 checklist

Every sensitive channel uses TLS or DTLS
No credentials, tokens or queries in plain TCP or UDP
Client rejects untrusted certificates
MQTT/CoAP and other IoT protocols are encrypted and authenticated
Modified or replayed messages are rejected

Run the checks yourself with the 7-day trial.