Deep Diving Into gRPC Security: A Case Study on API Security... - Dana White & Austin Pearigen
summary
StackHawk extends DAST to scan gRPC services by parsing file descriptor sets from Protobuf reflection and using the GRPC library’s DynamicMessage in Kotlin to build runtime requests, sending them over HTTP/2 via a ZAP-based scanner. A CLI spawns a local gRPC daemon for fast auth iteration and supports custom variable injection and Faker data so scans exercise branches. Proof it works: the scanner found SQL injection that returns a PostgreSQL exception. The system reports human-readable JSON results and integrates into CI.
AI-written summary · about
chapters (16)
- 0:00gRPC security intro
- 1:06What is DAST
- 2:30Authentication challenges in DAST
- 3:35gRPC for real-time auth feedback
- 5:21gRPC in StackHawk microservices
- 6:46DAST scanner for gRPC apps
- 8:31Scanning gRPC services challenges
- 9:53File descriptor sets for gRPC schema
- 10:34Dynamic message class in gRPC
- 12:20Variable injection in gRPC scans
- 13:46gRPC vulnerability scan demo
- 15:30Q&A vulnerability types
- 16:55Q&A scan config
- 18:19Q&A StackHawk vs ZAP
- 19:45Q&A deployment environments
- 20:28Closing
related talks
33mHunting Vulnerabilities of gRPC Protocol Armed Mobile/IoT Applications
08mModern GraphQL API Security Testing
09mHow to Make GraphQL Security Easier with StackHawk
30mSecuring Your Services with Authentication, Authorization, and RBAC in gRPC
15mDev-first API and application security testing
31mAuthentication and Security in gRPC Microservices
51mAPI Security: Securing GraphQL without going around in circles
26mPluggable Interception: Using ExtAuthz and ExtProc in gRPC Using XDS