I regularly perform pen-tests against web applications, operating systems, etc. Occasionally, I'm luck enough to do a 'red-teaming' exercise and get to attack at all conceivable points of a network (people etc as well) which is good fun and usually goes quite smoothly.
However, a client recently mentioned that they'd be interested in testing client-side (end-user) machines such as desktops/laptops as well, in order to see what type of attacks could be conducted against them, as a means of testing endpoint security (firewall/HIPS/AV/app whitelisting), and also to put their incident response program under stress.
They're looking at using custom malware to do this and are willing to let us try and propagate our own code in their environment.
Since most successful attacks these days involve client-side attacks (spear phishing, drive-by downloads, etc.) it makes sense to test the actual endpoints (which are usually a big problem). However, I'm worried that if we create a self-spreading piece of malware it will eventually get loose from the network, or that in one of the infinite possible application interactions, it will knock some server offline. Obviously the client will sign a waiver and shoulder risks like this.
Are client-side attack scenarios common requests? What other people do in these types of scenarios? Are there any methodologies to follow regarding the use of custom malware in client-side pentests?