Rpc API Security
JSON-RPC and XML-RPC API security testing, method enumeration, unauthenticated and...
Install
npx skills add xalgorix/xalgorix --skill rpc-api-security -g -a claude-code -y- Repository
- xalgorix/xalgorix1.3k
- Category
- Testing
- Updated
- 6d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,458 tokens
- Runs scripts
- No, instructions only
What it does
JSON-RPC and XML-RPC API security testing, method enumeration, unauthenticated and privileged RPC calls, batch authorization inconsistencies, method confusion, ID handling, and hidden internal method discovery
RPC API Security (JSON-RPC / XML-RPC)
Purpose
Exploit RPC-style APIs: enumerate callable methods, invoke privileged or internal methods with lower-privilege sessions, abuse batch semantics, and exploit ID/param handling, applying the same differential evidence contracts as REST skills.
Preconditions
- An identified JSON-RPC (POST with
{"jsonrpc":"2.0","method":...}) or XML-RPC (<methodCall>) endpoint - At least one valid session for differential testing
- The target's error behavior catalogued (invalid method, invalid params, authz failure)
Attack Surface Signals
- JSON bodies with
jsonrpc,method,params,idkeys Accept: application/jsonendpoints rejecting normal REST calls- Known frameworks: Ethereum nodes (
eth_*), Solr, supervisor, MantisBT, WordPress XML-RPC, CMS RPC layers /rpc,/jsonrpc,/xmlrpc.php,/api/jsonrpcpaths
Methodology
Step 1: Error-Triplet Baseline
curl -sk -X POST "https://TARGET/rpc" -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"no_such_method","params":[],"id":1}'
curl -sk -X POST "https://TARGET/rpc" -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"target_method","params":[],"id":1}'
Compare: unknown-method error vs real-method response (authz error, param error, or execution). Different error strings = method EXISTS and is callable to some depth. Catalog these before concluding anything.
