hunt-grpc

Start by fingerprinting gRPC ports with nmap and confirming ALPN h2 negotiation, then use grpcurl to list services via server reflection. Call sensitive methods without authentication and interpret grpc-status codes to distinguish real authorization failures from enforced controls.

Run grpcurl with the list command against the target port to retrieve every registered service, then use describe on each service and method to dump message schemas. Pipe the catalog into grep for admin, internal, debug, or delete patterns to prioritize targets.

grpcurl is the primary CLI client for listing, describing, and calling methods, while grpcui provides a web interface for interactive exploration. protoc and protoscope build raw protobuf and gRPC-Web frames, and buf drives Connect protocol endpoints.

Yes, reflection-off is a hardening control, not a security boundary. Recover .proto definitions from leaked repositories or swagger endpoints, compile them into a descriptor set with protoc, and pass it to grpcurl with the -protoset flag to drive the API.

Reflection exposure alone is information disclosure rated Low to Medium, since many vendors ship it intentionally. It becomes reportable when it reveals a non-public service catalog that leads to calling a sensitive method without authentication.

Only with explicit written authorization, since DoS testing is out of scope on most programs. Prefer version-matching the HTTP/2 stack from the server banner against known patched releases instead of sending reset floods, which produce unreliable results.