skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-grpc

Enumerate gRPC services and test authentication and metadata-stripping vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#security#api#microservices#grpc#pentest#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-grpc-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-grpc
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-grpc
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-grpc-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires grpcurl, protoc, buf.

What problem does it solve?

This skill addresses the security risks inherent in gRPC microservice architectures, where developers often mistakenly assume that internal services are protected by edge-only authentication.

Core Features & Use Cases

  • Service Enumeration: Automatically discover services and methods via reflection or proto-file analysis.
  • Authz Testing: Identify missing authentication on internal endpoints and test for metadata-stripping vulnerabilities.
  • Transcoder Analysis: Detect and exploit misconfigurations in gRPC-Web and grpc-gateway proxies that re-expose internal methods to the public.

Quick Start

Use the hunt-grpc skill to enumerate all available services and methods on the target host at port 50051.

Frequently Asked Questions about hunt-grpc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate gRPC services and methods during a pentest?▼

Yes, gRPC pentesting can identify missing authentication on internal endpoints and detect metadata-stripping vulnerabilities, targeting flaws where developers assume edge-only authentication protects internal microservices.

How do I test gRPC transcoder misconfigurations in grpc-gateway proxies?▼

Testing gRPC transcoder misconfigurations involves detecting and exploiting flaws in gRPC-Web and grpc-gateway proxies that mistakenly re-expose internal microservice methods to public access.

Do I need grpcurl and protoc to perform gRPC security assessments?▼

Yes, you need grpcurl and protoc installed, as these dependencies are required to perform service enumeration, proto-file analysis, and method invocation against target gRPC endpoints.

What is gRPC reflection analysis used for in API security testing?▼

gRPC reflection analysis is used in API security testing to automatically discover exposed services and methods without requiring source proto files, enabling rapid identification of attack surfaces in microservice architectures.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-grpc

Detect gRPC vulnerabilities including unauthenticated RPC access and metadata spoofing.

Community
Advanced
yunmengyayunmengya
80

php-auth-audit

Audit PHP authentication and authorization logic for missing security checks.

Community
Advanced
usk6666usk6666
11

yorishiro-proxy

Intercept, replay, and fuzz HTTP/S traffic via a Model Context Protocol interface.

Community
Advanced
trilwutrilwu
109

testing-apis

Identify and exploit API security weaknesses across REST and GraphQL endpoints.

Community
Advanced