# Rpc API Security

JSON-RPC and XML-RPC API security testing, method enumeration, unauthenticated and...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill rpc-api-security -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill rpc-api-security -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill rpc-api-security -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill rpc-api-security -g -a gemini-cli -y`

## Description

JSON-RPC and XML-RPC API security testing, method enumeration, unauthenticated and privileged RPC calls, batch authorization inconsistencies, method confusion, ID handling, and hidden internal method discovery

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# RPC API Security (JSON-RPC / XML-RPC)

## Purpose
Exploit RPC-style APIs: enumerate callable methods, invoke privileged or internal methods with lower-privilege sessions, abuse batch semantics, and exploit ID/param handling, applying the same differential evidence contracts as REST skills.

## Preconditions
- An identified JSON-RPC (POST with `{"jsonrpc":"2.0","method":...}`) or XML-RPC (`<methodCall>`) endpoint
- At least one valid session for differential testing
- The target's error behavior catalogued (invalid method, invalid params, authz failure)

## Attack Surface Signals
- JSON bodies with `jsonrpc`, `method`, `params`, `id` keys
- `Accept: application/json` endpoints rejecting normal REST calls
- Known frameworks: Ethereum nodes (`eth_*`), Solr, supervisor, MantisBT, WordPress XML-RPC, CMS RPC layers
- `/rpc`, `/jsonrpc`, `/xmlrpc.php`, `/api/jsonrpc` paths

## Methodology

### Step 1: Error-Triplet Baseline
```bash
curl -sk -X POST "https://TARGET/rpc" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"no_such_method","params":[],"id":1}'
curl -sk -X POST "https://TARGET/rpc" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"target_method","params":[],"id":1}'
```
Compare: unknown-method error vs real-method response (authz error, param error, or execution). Different error strings = method EXISTS and is callable to some depth. Catalog these before concluding anything.

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/rpc-api-security/SKILL.md