Attacking Grpc Protobuf

What to Test

The bug classes are the same as any API, but gRPC changes where they hide.

Authorization per method. gRPC has no path-based access control, so a reverse proxy or WAF that filters /admin/* does nothing. Each method must check authorization itself — enumerate every method from reflection and call each one with a low-privilege token.

for m in $(grpcurl -plaintext target:50051 list package.Service | tail -n +2); do
  echo "== $m"; grpcurl -H "authorization: Bearer $LOW_PRIV" -plaintext -d '{}' target:50051 "$m" 2>&1 | head -3
done

Internal services exposed. gRPC is a service-mesh protocol, so many services were written assuming only other services would call them. If you can reach one directly, expect no authentication at all — and expect it to trust identity claims passed as ordinary request fields or metadata.

Metadata trust. Look for headers the service reads as identity: x-user-id, x-tenant-id, x-forwarded-user. If a gateway sets them and the service trusts them, sending them yourself is a complete authentication bypass.

grpcurl -H 'x-user-id: 1' -H 'x-role: admin' -plaintext -d '{}' target:50051 package.Service/GetProfile

Unknown-field injection. Protobuf ignores fields it does not recognize, but intermediate services may forward them. More usefully: add fields the client never sends but the server schema defines — is_admin, internal_notes, tenant_id — the mass-assignment equivalent.

Type confusion and resource exhaustion. Wire types are loosely enforced; send a bytes where a string is expected, deeply nested messages to blow the recursion limit, or a huge repeated field. Check for a configured message size limit.

TLS and mTLS posture. Many gRPC deployments use insecure channels internally. Check whether the service accepts plaintext, and whether mTLS is required or merely optional.

Rationalizations to Reject

• "Burp shows nothing, the app isn't making requests." Burp needs HTTP/2 enabled, and gRPC clients often bypass the system proxy entirely.
• "I don't have the .proto, so I can't test it." protoc --decode_raw recovers structure from any message. Field numbers are all you need.
• "Reflection is disabled, so the methods are hidden." The client knows the schema. Extract the descriptors from the client binary.
• "The gateway enforces authorization." The gateway sees method names, not intent, and anything that reaches the service directly bypasses it entirely.
• "It's internal-only." Confirm that. Service meshes leak, and "internal" usually means "no authentication".
• "The client never sends that field." You are not the client.

<!-- attack:start -->

ATT&CK Coverage

Generated from secskills-core/ttp-index.json — edit that file, then run python3 scripts/sync_attack.py --write. Re-verify IDs against the current ATT&CK release before citing them in a report.

Initial Access (TA0001)

• T1190 Exploit Public-Facing Application — see also testing-web-applications, testing-apis, enumerating-network-services, attacking-graphql, exploiting-deserialization, exploiting-ssrf, exploiting-xxe

Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.

<!-- attack:end -->

References

• testing-apis — the general API methodology this specializes
• auditing-code-for-vulnerabilities — reading .proto and handlers in source
• bypassing-mobile-pinning — when a mobile gRPC client ignores your proxy
• exploiting-cloud-platforms — service mesh and internal exposure context
• grpcurl, grpcui, protoc, protobuf-inspector, protod, mitmproxy