A penetration test methodology to be used in conjunction with relevant OWASP WSTG - v4.2 on Electron desktop application assessments.
Based largely off of Luca Carettoni's Electron Security Checklist: A guide for developers and auditors
A majority of these checks require decompiling the Electron application (see: Decompiling and repacking Electron Apps). Note that it may need to be deobfuscated, unminified.
A majority of these checks can be conducted using Electronegativity.
- Sensitive Information Extraction
- Code Execution from Untrusted Content)
- Unsandboxed Process Execution
- Unsafe Command Line Arguments
- Improper Use of Preload Scripts
- Chromium Web Security Override
- Insecure Communication
- Chromium Experimental Features
- Allowed Navigation to Untrusted Origins
- Unhandled Session Permission Requests from Remote Content
- JavaScript, CSS Injection
- Clickjacking via Popups
- Unsafe Custom Protocol Handlers
- User Host Compromise