Detect gRPC vulnerabilities including unauthenticated RPC access and metadata spoofing.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-grpc-uphiago
Please help me install this Agent Skill. Skill: hunt-grpc Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-grpc Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-grpc-uphiago
gRPC services in microservice architectures are often assumed to be internal and secure, but common misconfigurations like enabled server reflection, missing authentication on internal endpoints, and unstripped proxy-injected metadata expose them to critical vulnerabilities including unauthenticated access to privileged RPC methods, cross-tenant impersonation, and denial-of-service attacks. This skill provides a structured, field-validated workflow to systematically identify and exploit these gRPC-specific security gaps that are missed by standard web vulnerability scanners.
Use the hunt-grpc skill to assess a target's gRPC services for unauthenticated admin method access, metadata spoofing vulnerabilities, and HTTP/2 Rapid Reset DoS exposure, following the structured 7-phase workflow to validate findings and avoid false positives.
High-intent search queries and answers about installing and using this skill.
gRPC server reflection allows clients to query service definitions dynamically, exposing available RPC methods and message structures. During penetration testing, this mechanism reveals internal services and unauthenticated methods that standard web vulnerability scanners cannot detect.
gRPC server reflection allows clients to query service definitions dynamically, exposing available RPC methods and message structures. During penetration testing, this mechanism reveals internal services and unauthenticated methods that standard web vulnerability scanners cannot detect.
Test cross-tenant impersonation by spoofing proxy-injected metadata headers in gRPC requests to bypass trust boundaries. This skill identifies misconfigurations where unstripped metadata allows attackers to impersonate tenants and access privileged functionality.
Yes, grpcurl is required for service enumeration and RPC invocation against gRPC targets on common ports like 50051, 443, 8443, and 9090. The skill uses grpcurl alongside protoc and protoscope for protobuf descriptor handling during assessments.
Yes, the workflow includes HTTP/2 Rapid Reset DoS validation as part of its 7-phase assessment. It requires explicit written authorization for DoS testing to comply with program scope rules before attempting any denial-of-service exposure validation.
Testing gRPC-Web endpoints fronted by Envoy proxies or grpc-gateway transcoders requires handling transcoded HTTP/1.1 attack surfaces. The skill addresses these specific configurations but standard web scanners miss these exposed internal services via transcoded endpoints.
erikshaferManage gRPC and protobuf configurations with buf and grpcurl.
elementalsoulsIdentify gRPC misconfigurations, exposed reflections, and unauthenticated access vectors.
xalgordDetect gRPC and Protocol Buffers service vulnerabilities via reflection and metadata testing.
SensLiaoAssess REST, GraphQL, and gRPC APIs against OWASP API Security Top 10:2023.
