gRPC-Web Coder
Summary: PortSwigger's BApp Store lists a Burp Suite extension called gRPC-Web Coder, version 2.0.0, by Amin Nasiri, last updated 12 November 2026, that decodes and re-encodes gRPC-Web request and response bodies in the message editor without the target's .proto schema. The extension unwraps protobuf length-prefixed framing and base64 encoding in application/grpc-web-text bodies, infers a type for every protobuf field, presents the result as editable JSON, and re-encodes edits so payloads can be tampered with in Proxy, Repeater and Intruder.
What you should know: gRPC-Web bodies arrive as opaque blobs that ordinary testing techniques do not reach, and this extension removes that barrier for anyone running Burp - so the assumption that your gRPC-Web endpoints are harder to probe than your REST APIs no longer holds.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026