# Security testing

**URL:** <https://community.thinlinc.com/t/security-testing/934>\
**Category:** Community Support\
**Tags:** linux\
**Created:** [3 May 2024 06:33 UTC](https://community.thinlinc.com/t/security-testing/934 "2024-05-03T06:33:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vich](https://avatars.discourse-cdn.com/v4/letter/v/d9b06d/32.png) [@Vich](https://community.thinlinc.com/u/Vich)\
**Post date:** [3 May 2024 06:33 UTC](https://community.thinlinc.com/t/security-testing/934/1 "2024-05-03T06:33:25Z")

</div>

Do you fuzz test this application? Show an example of a target, please.

---

<div class="post-metadata">

**Author:** ![samuel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/samuel/32/335_2.png) [@samuel](https://community.thinlinc.com/u/samuel)\
**Post date:** [3 May 2024 12:30 UTC](https://community.thinlinc.com/t/security-testing/934/2 "2024-05-03T12:30:28Z")

</div>

Please elaborate a bit on what you’re after. We definitely test the core parts of the software with invalid, malformed, or unexpected inputs.

---

<div class="post-metadata">

**Author:** ![Vich](https://avatars.discourse-cdn.com/v4/letter/v/d9b06d/32.png) [@Vich](https://community.thinlinc.com/u/Vich)\
**Post date:** [3 May 2024 13:38 UTC](https://community.thinlinc.com/t/security-testing/934/3 "2024-05-03T13:38:17Z")

</div>

I’m planning to fuzz and want to decide on a target

---

<div class="post-metadata">

**Author:** ![samuel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/samuel/32/335_2.png) [@samuel](https://community.thinlinc.com/u/samuel)\
**Post date:** [3 May 2024 14:25 UTC](https://community.thinlinc.com/t/security-testing/934/4 "2024-05-03T14:25:41Z")

</div>

The most important targets would be the ThinLinc master service (VSM server) and the ThinLinc Web Access service. These are the two login interfaces for a ThinLinc system.

Our native clients (desktop applications) connect to the master service via SSH. Our web client connects via the Web Access service. Some info about the ports used here:

[https://www.cendio.com/resources/docs/tag/tcp-ports\_server.html](https://www.cendio.com/resources/docs/tag/tcp-ports_server.html)

---

<div class="post-metadata">

**Author:** ![crompton](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/crompton/32/34_2.png) [@crompton](https://community.thinlinc.com/u/crompton)\
**Post date:** [10 December 2025 14:43 UTC](https://community.thinlinc.com/t/security-testing/934/5 "2025-12-10T14:43:37Z")

</div>

Did you end up performing some testing @Vich? I’m curious if you found anything noteworthy.