Hunt Grpc
Hunt gRPC vulnerabilities, server reflection enabled (enumerate all services/methods)...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-grpc -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt gRPC vulnerabilities, server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture.
HUNT-GRPC, gRPC Security
Crown Jewel Targets
gRPC reflection enabled = full service catalog enumeration without source code. The highest-value gRPC bugs come from the architectural assumption that a service is "internal", auth is enforced at the edge proxy, and the backend trusts any caller that reaches it. Once you reach the backend directly (exposed port, SSRF, proxy bypass), that trust collapses.
Highest-value findings:
- Reflection enabled in production,
grpc.reflection.v1alpha.ServerReflection/grpc.reflection.v1.ServerReflectionlists every method, message, and internal service. Enumeration enabler, not a vuln on its own (see Validation). - Missing auth on internal service, a service designed for east-west microservice traffic exposed externally with no mTLS and no per-method authorization → call privileged methods directly.
- Edge-auth-only / metadata-stripping, proxy authenticates the user but the backend re-trusts proxy-injected headers (
x-user-id,x-tenant-id,x-forwarded-*); if you reach the backend or can inject those headers via the proxy, you impersonate any tenant. - Plaintext gRPC, gRPC h2c (cleartext HTTP/2) on a non-standard port → credential/metadata interception.
- HTTP/2 Rapid Reset DoS (CVE-2023-44487), interleaved HEADERS + immediate RST_STREAM frames bypass
MAX_CONCURRENT_STREAMSaccounting → resource exhaustion. DoS is in scope on almost no program, get explicit written authorization before sending a single burst.
Phase 1, Fingerprint & Port Discovery
# Common gRPC ports (50051 native; 443/8443 via TLS+ALPN h2; 9090/8080 h2c)
nmap -sV -p 50051,50052,443,9090,8080,8443,6565,9000 $TARGET 2>/dev/null | grep open
# ALPN must negotiate h2, gRPC cannot run on HTTP/1.1
echo | openssl s_client -alpn h2 -connect $TARGET:443 2>/dev/null | grep -i "ALPN.*h2"
