TL;DR: Protobuf encoding tricks, reflection enabled, missing TLS, missing per-method auth, server streaming abuse.

Stub — to be filled in.

What it is

TODO

Preconditions / where it applies

TODO

Technique

TODO

Detection and defence

TODO

References

• https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-web/grpc-web-pentest.html