gRPC API Security

Purpose

Test gRPC services for reflection exposure, method-level authorization, message tampering, and gateway/REST transcoding inconsistencies.

Preconditions

• A gRPC endpoint identified (typically port 50051, 443 with gRPC content-type, or via gateway)
• grpcurl available (or ability to install: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest)

Attack Surface Signals

• HTTP/2 with Content-Type: application/grpc or application/grpc+proto
• Port 50051, 50052, 6565 commonly used for gRPC
• grpc-status in response trailers
• gRPC-Web content-type: application/grpc-web+proto
• Gateway that proxies REST to gRPC (transcoding)

Methodology

Service Discovery via Reflection

# List services (if reflection is enabled)
grpcurl -plaintext TARGET:50051 list

# List methods for a service
grpcurl -plaintext TARGET:50051 list mypackage.MyService

# Get message descriptors
grpcurl -plaintext TARGET:50051 describe mypackage.MyService/GetUser

Direct Method Invocation

# Call a method with parameters
grpcurl -plaintext -d '{"id": "123"}' TARGET:50051 mypackage.MyService/GetUser

# Try calling admin methods with a regular user token
grpcurl -plaintext -H "authorization: Bearer USER_TOKEN" \
  -d '{"id": "123"}' TARGET:50051 mypackage.AdminService/DeleteUser

Method-Level Authorization Testing

# Test if per-method auth is enforced (not just per-service)
for method in GetUser ListUsers CreateUser DeleteUser UpdateUser; do
  result=$(grpcurl -plaintext -d '{}' TARGET:50051 "mypackage.UserService/$method" 2>&1)
  echo "[$method] $result" | head -1
done

# Test anonymous access
grpcurl -plaintext -d '{"id": "1"}' TARGET:50051 mypackage.UserService/GetUser

Message Tampering

# Object ID manipulation (BOLA in gRPC)
grpcurl -plaintext -H "authorization: Bearer USER_A_TOKEN" \
  -d '{"user_id": "USER_B_ID"}' TARGET:50051 mypackage.UserService/GetUser