hunt-grpc
能发现因架构信任假设导致的高危后端缺陷。
可能用于未授权内网探测或滥用，谨慎使用
识别 gRPC 服务反射、明文传输与未鉴权内网接口等安全问题。
检查 gRPC 服务的安全弱点：是否开启 reflection（能枚举所有服务/方法）、是否缺少鉴权、是否明文传输、proto 文件泄露或网关转码注入等。适合在发现 50051/443/8443/9090 等 gRPC 端口或使用 grpcurl/grpcui 能探测到反射时用。重点是找出那种“内部信任”被绕过后会被滥用的后端漏洞。
▸ 展开 SKILL.md 英文原文
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-grpc/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-grpc/SKILL.md"# HUNT-GRPC — gRPC Security ## Crown Jewel Targets gRPC reflection enabled = full service catalog enumeration without source code. The highest-value gRPC bugs come from the architectural assumption that a service is "internal" — auth is enforced at the edge proxy, and the backend trusts any caller that reaches it. Once you reach the backend directly (exposed port, SSRF, proxy bypass), that trust collapses. **Highest-value findings:** - **Reflection enabled in production** — `grpc.reflection.v1alpha.ServerReflection` / `grpc.reflection.v1.ServerReflection` lists every method, message, and internal service. Enumeration enabler, not a vuln on its own (see Validation). - **Missing auth on int