Summary
GrpcEndpointDetectionTestCase probes for gRPC services over the shared HttpClient, which wraps an OkHttp client configured for standard HTTP/1.1. Real gRPC servers only speak HTTP/2 (typically cleartext/h2c for internal services, as in these test labs). Because the client never negotiates HTTP/2 prior-knowledge, it cannot complete a connection to a gRPC service at all — the probe request fails at the transport layer before there's any response to inspect for content-type: application/grpc.
Location
src/main/java/org/owasp/astf/testcases/GrpcEndpointDetectionTestCase.java (detectGrpcEndpoint, detectServerReflection)src/main/java/org/owasp/astf/core/http/HttpClient.java:63-66 (OkHttpClient builder — no Protocol.H2_PRIOR_KNOWLEDGE)
Reproduction
Built and ran gRPC Goat labs 001 (server reflection enabled) and 002 (plaintext gRPC) locally. Confirmed both were live and serving:
$ docker logs grpc-goat-001
2026/07/25 04:23:42 gRPC server starting on port 8001...
Scanning both with --test-cases ASTF-GRPC-2023 produced 0 findings on both, including lab001 which is specifically the "reflection enabled" scenario ASTF's own test case is designed to catch.
Confirmed the transport-level cause manually:
$ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8001/
000 # plain HTTP/1.1 — connection never completes
$ curl -s -o /dev/null -w "%{http_code}" --http2-prior-knowledge http://127.0.0.1:8001/
415 # real HTTP/2 connection succeeds — server is genuinely reachable
Suggested fix
Configure a dedicated OkHttpClient (or separate lightweight HTTP/2 client) for this test case with .protocols(List.of(Protocol.H2_PRIOR_KNOWLEDGE)) for cleartext gRPC targets, and standard ALPN-negotiated HTTP/2 for TLS gRPC targets, so the probe can actually complete a connection before checking for application/grpc response signals.
Impact
As currently implemented, ASTF-GRPC-2023 cannot detect any real gRPC service over gRPC's actual wire protocol — it will report "not gRPC" (silently, via a caught exception) against every legitimate gRPC target.
Companion to #70, #71 — found during a manual verification pass of ASTF v1.0.0 against VAmPI, crAPI, DVGA, and gRPC Goat.
Summary
GrpcEndpointDetectionTestCaseprobes for gRPC services over the sharedHttpClient, which wraps an OkHttp client configured for standard HTTP/1.1. Real gRPC servers only speak HTTP/2 (typically cleartext/h2c for internal services, as in these test labs). Because the client never negotiates HTTP/2 prior-knowledge, it cannot complete a connection to a gRPC service at all — the probe request fails at the transport layer before there's any response to inspect forcontent-type: application/grpc.Location
src/main/java/org/owasp/astf/testcases/GrpcEndpointDetectionTestCase.java(detectGrpcEndpoint,detectServerReflection)src/main/java/org/owasp/astf/core/http/HttpClient.java:63-66(OkHttpClient builder — noProtocol.H2_PRIOR_KNOWLEDGE)Reproduction
Built and ran gRPC Goat labs 001 (server reflection enabled) and 002 (plaintext gRPC) locally. Confirmed both were live and serving:
Scanning both with
--test-cases ASTF-GRPC-2023produced 0 findings on both, including lab001 which is specifically the "reflection enabled" scenario ASTF's own test case is designed to catch.Confirmed the transport-level cause manually:
Suggested fix
Configure a dedicated OkHttpClient (or separate lightweight HTTP/2 client) for this test case with
.protocols(List.of(Protocol.H2_PRIOR_KNOWLEDGE))for cleartext gRPC targets, and standard ALPN-negotiated HTTP/2 for TLS gRPC targets, so the probe can actually complete a connection before checking forapplication/grpcresponse signals.Impact
As currently implemented,
ASTF-GRPC-2023cannot detect any real gRPC service over gRPC's actual wire protocol — it will report "not gRPC" (silently, via a caught exception) against every legitimate gRPC target.Companion to #70, #71 — found during a manual verification pass of ASTF v1.0.0 against VAmPI, crAPI, DVGA, and gRPC Goat.