I am familiar with web security but I would like to know more about non-web application security.
I know about memory corruption vulnerabilities like buffer overflow and buffer overread and how serious they are. But how about Java/C# or similar applications, where memory corruption vulnerabilities are far less common.
I'm assuming you could test for all server-side vulnerabilities like SQL-injection or OS-command injection like you test on a web app. I also know that Java/C# apps could be vulnerable to insecure deserialization. But what else could a desktop app pentester check?
Is there any training provider for desktop app security like how it is Portswigger for web security? Is there a methodology or even a checklist of what you could check?
