| name | api-grpc |
| description | Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, ports like 50051), grpc-web, or "protobuf". Signals: grpc, protobuf, reflection service, ServerReflection.
|
| domain | api |
| type | technique |
| stability | learning |
| modes | ["bugbounty","pentest"] |
| severity | high |
| owasp_api | ["API1:2023-BOLA","API5:2023-BFLA"] |
| cwe | ["CWE-284"] |
| tools | ["grpcurl","grpcui","buf","burp"] |
| schema_version | 1 |
gRPC / Protobuf API attacks
When it applies
The target exposes gRPC (or grpc-web). Binary framing over HTTP/2 makes it feel opaque, but the
same authz/injection bugs apply — and server reflection often hands you the whole API.
Why it works
gRPC methods are RPCs with typed messages; security still lives per-method. Reflection (if on)
exposes every service/method, and teams frequently skip auth on internal-looking RPCs or trust
the client-generated stubs to enforce access.
Method
- Enumerate via reflection:
grpcurl -plaintext host:50051 list then list <service> and
describe <method>; grpcui for an interactive UI. No reflection? Recover .proto from the
client/mobile app or JS (grpc-web).
- Call methods directly:
grpcurl -d '{"id":123}' host:port pkg.Service/Method — test
BOLA/BFLA by calling privileged methods or swapping object ids with a low-priv token.
- Auth testing: replay with/without metadata (the gRPC equivalent of headers/tokens); many
servers authenticate the connection but not each method.
- Injection: message fields feed backends — test SQLi/NoSQLi/command injection in string fields.
- grpc-web: it rides HTTP/1.1+base64 — proxy through Burp, decode frames, tamper.
Gotchas
- Reflection off ≠ safe — extract the schema from clients; then
grpcurl with a local .proto.
- Binary framing hides bugs from scanners; manual method-by-method testing is the win.
- HTTP/2 + TLS: use
-plaintext only when the service is plaintext; otherwise pass certs.
Verify success
Call a method your role shouldn't reach, read/modify another object, or land an injection —
proving per-method authz or input handling is broken.
References
grpcurl/grpcui docs; OWASP API Security (2023); "hacking gRPC" write-ups.
