BLIND ENUMERATION OF GRPC SERVICES

Summary from the TLDR InfoSec newsletter

Adversis developed grpc-scan to automate service discovery on gRPC endpoints when reflection is disabled and documentation is minimal, exploiting how different gRPC implementations return distinct error codes (UNIMPLEMENTED vs NOT_FOUND) to differentiate between non-existent services and valid services with invalid methods. The tool systematically tests thousands of service/method combinations using common naming patterns and leverages HTTP/2 multiplexing for efficient scanning, revealing common security anti-patterns like legacy services with weaker authentication, method proliferation where newer methods bypass security checks, and "internal" services exposed on public endpoints. Security professionals should recognize that gRPC's opacity often creates a false sense of security through obscurity, and should implement proper service inventory management, consistent authentication across all service versions, and network segmentation rather than relying on undocumented APIs for protection.