Attacking gRPC and Protobuf Services

gRPC breaks the tooling assumption that a request is readable text over HTTP/1.1. Burp shows a binary blob or nothing at all, and without the schema you cannot even name the methods. Recover the schema and it becomes an ordinary API test — with the twist that gRPC services are frequently internal services newly exposed, which means their authorization is often weaker than the REST API in front of them.

When to Use

• Traffic uses HTTP/2 with content-type: application/grpc
• A request or response body is opaque binary with no JSON structure
• The app is a mobile or desktop client talking to a backend over protobuf
• You find .proto files, *_pb2.py, *.pb.go, or grpc in a codebase
• application/grpc-web or application/grpc-web+proto appears in a browser app

When NOT to Use