# Grpc API Security

GRPC API security testing covering reflection, service enumeration, method-level...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill grpc-api-security -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill grpc-api-security -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill grpc-api-security -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill grpc-api-security -g -a gemini-cli -y`

## Description

gRPC API security testing covering reflection, service enumeration, method-level authorization, message tampering, and transcoded REST inconsistencies

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# gRPC API Security

## Purpose
Test gRPC services for reflection exposure, method-level authorization, message tampering, and gateway/REST transcoding inconsistencies.

## Preconditions
- A gRPC endpoint identified (typically port 50051, 443 with gRPC content-type, or via gateway)
- grpcurl available (or ability to install: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest)

## Attack Surface Signals
- HTTP/2 with `Content-Type: application/grpc` or `application/grpc+proto`
- Port 50051, 50052, 6565 commonly used for gRPC
- `grpc-status` in response trailers
- gRPC-Web content-type: `application/grpc-web+proto`
- Gateway that proxies REST to gRPC (transcoding)

## Methodology

### Service Discovery via Reflection
```bash
# List services (if reflection is enabled)
grpcurl -plaintext TARGET:50051 list

# List methods for a service
grpcurl -plaintext TARGET:50051 list mypackage.MyService

# Get message descriptors
grpcurl -plaintext TARGET:50051 describe mypackage.MyService/GetUser
```

### Direct Method Invocation
```bash
# Call a method with parameters
grpcurl -plaintext -d '{"id": "123"}' TARGET:50051 mypackage.MyService/GetUser

# Try calling admin methods with a regular user token
grpcurl -plaintext -H "authorization: Bearer USER_TOKEN" \
  -d '{"id": "123"}' TARGET:50051 mypackage.AdminService/DeleteUser
```

### Method-Level Authorization Testing
```bash
# Test if per-method auth is enforced (not just per-service)
for method in GetUser ListUsers CreateUser DeleteUser UpdateUser; do
  result=$(grpcurl -plaintext -d '{}' TARGET:50051 "mypackage.UserService/$method" 2>&1)
  echo "[$method] $result" | head -1
done

# Test anonymous access
grpcurl -plaintext -d '{"id": "1"}' TARGET:50051 mypackage.UserService/GetUser
```

### Message Tampering
```bash
# Object ID manipulation (BOLA in gRPC)
grpcurl -plaintext -H "authorization: Bearer USER_A_TOKEN" \
  -d '{"user_id": "USER_B_ID"}' TARGET:50051 mypackage.UserService/GetUser

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/grpc-api-security/SKILL.md