gRPC Pentesting

Default port: 50051

Tools: grpcurl https://github.com/fullstorydev/grpcurl/releases

Commands:

1) List the server's services

grpcurl -plaintext TARGET_IP:PORT list 

2) List the methods of a specific service

grpcurl -plaintext TARGET_IP:PORT list SERVICE 

3) Obtain further information on the specific service or method

grpcurl -plaintext TARGET_IP:PORT describe SERVICE 

4) Submit data to a specific endpoint

grpcurl -plaintext -vv -format text -d 'USERNAME: "USER", PASSWORD: "PASS"' TARGET_IP:PORT ENDPOINT 

5)

grpcurl -plaintext -format text -H 'HEADER:WHATEVER' -d 'DATA: "DATA"' TARGET_IP:PORT ENDPOINT