Lu3ky13 GitHub avatar

gRPC-Web-Burp-Repeater

Lu3ky13

A Burp Suite extension that intercepts, decodes, edits, and replays gRPC-Web traffic by automatically converting binary protobuf to human-readable JSON and back.

Stars

7

7-day growth

No data

Forks

2

Open issues

0

License

No data

Last updated

2026-07-28

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It solves a common pain point for security testers by enabling full editing and replay of gRPC-Web requests without requiring .proto schemas, bridging a critical gap in modern API testing.

Who it is for

  • Penetration testers working with microservices and cloud platforms
  • Bug bounty hunters targeting modern web applications with gRPC-Web APIs
  • Security researchers studying protobuf-based protocols
  • Red teamers needing to test gRPC endpoints in Burp Suite

Use cases

  • Testing for IDOR, auth bypass, and injection vulnerabilities in gRPC-Web APIs
  • Replaying and modifying gRPC-Web requests during bug bounty hunting
  • Penetration testing microservices architectures that use gRPC
  • Rapid prototyping of payloads using built-in SSRF and XSS templates

Strengths

  • Schemaless protobuf decoding works without .proto files, lowering the barrier for testing
  • Full Repeater functionality with automatic decode/edit/encode cycle
  • Built-in payload generator with pre-built SSRF and XSS templates
  • Logs all gRPC-Web traffic with decoded content for easy review

Considerations

  • Requires Jython standalone JAR to be configured in Burp, adding an extra setup step
  • Only activates for requests with specific gRPC-Web content types, limiting scope
  • Uses numbered JSON field keys (e.g., "1", "2") rather than original field names, which may require manual mapping

README quick start

Installation

Description

A powerful Burp Suite extension for **penetration testers** and **bug bounty hunters** to intercept, decode, edit, and replay **gRPC-Web** traffic.

Related repositories

Similar projects matched by category, topics, and programming language.

gavamedia
Featured
gavamedia GitHub avatar

deltafin

Deltafin is a research project that runs the 2.8-trillion-parameter Mixture-of-Experts model Kimi K3 on a single Apple Silicon Mac (e.g., M1 Max with 64 GB) at about 16 seconds per token, using exact, reproducible inference with local or streaming expert loading.

AI & Machine LearningLarge Language Models
304
react
Featured
react GitHub avatar

react

React is a JavaScript library for building user interfaces with declarative, component-based, and cross-platform design.

Web DevelopmentFrontend Frameworks
246,741
TanStack
Featured
TanStack GitHub avatar

router

TanStack Router is a type-safe, data-driven React router with built-in caching, prefetching, and nested layouts, while TanStack Start extends it into a full-stack SSR framework.

Web DevelopmentFrontend Frameworks
14,861