skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-grpc

Identify gRPC misconfigurations, exposed reflections, and unauthenticated access vectors.

3.3k|507|Updated May 5, 2026
Search Tags:#security#vulnerability#reflection#grpc#pentest#auth-bypass#grpc-web
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-grpc-elementalsouls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-grpc
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-grpc
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-grpc-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hunt gRPC vulnerabilities by identifying misconfigurations, exposed reflections, and access vectors that bypass normal auth controls.

Core Features & Use Cases

  • Enumerate gRPC services and methods when reflection is enabled to build a complete catalog of surface exposure.
  • Validate internal-service exposure through missing auth, metadata-stripping, and plaintext gRPC on HTTP/2 to reveal sensitive interfaces.
  • Assess gRPC-Web/grpc-gateway/transcoding surfaces to uncover externally reachable endpoints that bypass authorization.
  • Identify proto/file leakage and potential exposure of internal descriptors that enable further testing.
  • Phase-driven workflow guidance for fingerprinting, auth-bypass, and descriptor discovery in modern microservice architectures.

Quick Start

Describe your test target in plain English and let the skill load the gRPC surface map, methods, and potential auth gaps.

Frequently Asked Questions about hunt-grpc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find gRPC misconfigurations and exposed reflection services?▼

To find gRPC misconfigurations, you can assess target services on HTTP/2 ports to identify exposed reflections, enumerate service methods, and detect plaintext gRPC interfaces lacking proper authentication controls.

What is the best way to test for gRPC auth bypass and metadata stripping?▼

Testing for gRPC auth bypass involves probing modern microservice architectures to validate missing authentication, detecting metadata-stripping proxies, and uncovering externally reachable endpoints that bypass normal authorization controls.

Can I assess gRPC-Web and grpc-gateway transcoding surfaces for external exposure?▼

Yes, you can assess gRPC-Web and grpc-gateway transcoding surfaces to uncover externally reachable endpoints. This process identifies sensitive interfaces exposed through proxies that bypass standard authorization mechanisms.

How do I enumerate gRPC services when reflection is enabled?▼

Enumerating gRPC services with reflection enabled allows you to build a complete catalog of surface exposure. This reveals available methods and potential internal-service exposure for further targeted testing.

What are the limitations of probing gRPC descriptors during a pentest?▼

Limitations include the need for controlled probing to validate findings without disruption. Familiarity with gRPC reflection, metadata handling, and HTTP/2 is required to safely identify proto file leakage and internal descriptors.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
846

grpc-protobuf

Detect gRPC and Protocol Buffers service vulnerabilities via reflection and metadata testing.

Community
Intermediate
jassicsjassics
6

vector-store-isolation-test

Validate per-user and per-tenant authorization in RAG retrieval systems.

Community
Advanced
usk6666usk6666
11

yorishiro-proxy

Intercept, replay, and fuzz HTTP/S traffic via a Model Context Protocol interface.

Community
Advanced
EntroVyxEntroVyx
3

hunt-grpc

Enumerate gRPC services and test authentication and metadata-stripping vulnerabilities.

Community
Advanced