Discovery over the wire
// tool: discover_grpcgRPC is auto-detected as an API protocol inside a normal API scan. Transport security is probed first — plaintext h2c versus TLS, and whether that certificate is self-signed — then the service surface is enumerated. Where reflection is switched off, point the scan at your .proto files and it compiles the message shapes itself.
// SERVER REFLECTION low–medium
Reflection being enabled is itself recorded as an exposure: it hands an attacker your complete internal API surface, including the administrative methods you assumed nobody knew the name of.
// TRANSPORT
Plaintext and self-signed transport are recorded as observations — the honest ceiling for something that may be deliberate inside a mesh. What gets promoted to a finding is a trust boundary that doesn't hold.
Broken mutual TLS
// tool: scan_grpcThe failure that mTLS is supposed to make impossible: a server that demands a client certificate and then accepts an untrusted one. Everything downstream — service identity, per-service authorisation, the whole zero-trust story — is decoration if any client can present a self-signed cert and be believed.
// THE DIFFERENTIAL THAT MAKES IT A FINDING high
Requiring both halves is what keeps this clean. A server that accepts everyone isn't running mTLS at all (different finding); a server that refuses our cert is doing its job and stays silent.
Injection into protobuf fields
// tool: fuzz_grpcInternal services get the least input validation, because "only our own code calls them". Each unary method is invoked per field with the same payload classes and the same confirmation oracles the HTTP detectors use — an evaluated result or a genuine differential, never a reflected payload.
SQL INJECTION
A boolean TRUE/FALSE row-count differential plus the error-based signal. The differential means blind injection is caught without timing tricks.
COMMAND INJECTION
Confirmed on real command output in the response message — the marker, never the echoed payload.
SSRF
A canary URL the scanner controls, confirmed when its content comes back in-band through the method's response.
Measured against gRPC Goat
// 6 verified / 8 detected of 9 labsScored against the gRPC Goat lab suite rather than asserted. Six labs produce a verified finding: reflection enabled, two broken-mTLS variants, SQL injection, command injection and SSRF. Two more are detected at their honest ceiling as observations — plaintext gRPC and a self-signed certificate. The ninth publishes no TCP port at all (a host-local Unix socket), so it is out of network scope rather than a coverage gap, and we say so instead of counting it.
// KNOWN LIMITS, STATED UP FRONT
Fuzzing covers unary methods; streaming methods are not fuzzed yet. Servers with reflection disabled need you to supply the .proto files — autonomous discovery of them is on the backlog, not in the product. A safe-control check suite gates every gRPC change, and the offline benchmark floor stays at full recall with zero false positives.
How it's recorded
// audit-ready evidenceCATEGORY
Injection maps to OWASP API8, broken mTLS to API2 / CWE-295, reflection exposure to CWE-200.
SEVERITY
One calibrated severity per finding that translates into each framework's risk rating and remediation SLA — no inflated numbers.
EVIDENCE
The service and method invoked, the field carrying the payload, and the response message that confirmed it.
Point it at your mesh.
NewScan is free and self-hosted — bring your own key. gRPC discovery, the mTLS differential and the injection fuzzing all run in the deterministic floor with no model or provider key at all.