Menu

Individual skill

hunt-firebase

0upvotes

Hunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase Hosting detection, GCP service account JSON exploitation, IAM policy enumeration from leaked SA keys. Built from field experience where Firebase API keys in JS bundles unlocked full Firestore read-access on 12+ targets including healthcare platforms and delivery apps. Use when a JS bundle, APK, or .env file reveals a Firebase API key (AIzaSy...) or when target uses firebaseio.com / firestore.googleapis.com endpoints.

redteam/hunt-firebase/SKILL.md

Read pinned source

Source commit 1260244136edc6ae698d76d3d526f503e322778d

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,332
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# HUNT-FIREBASE — Firebase / Firestore / GCP Exploitation

## Crown Jewel Targets

Firebase is Google's mobile/web platform. When developers embed the **API key** in the client (which is required by Firebase SDKs), they often forget to configure **Firestore Security Rules** or **Realtime Database Rules**, leaving all data publicly readable and writable.

**Highest-value findings:**
1. **Public Firestore Database** — anon key allows read/write to ALL collections → full data dump (users, messages, PII). Critical.
2. **Public Realtime Database** — `{database}.firebaseio.com/.json` returns all data without auth. Critical.
3. **Firebase Storage with public read** — storage bucket allows anonymous file listing and download. Critical.
4. **Firebase signUp open** — anyone can create an auth account, then use the JWT to access Firestore. High.
5. **Service Account JSON leaked** — full GCP IAM access to Firestore, Storage, Cloud Functions, IAM policy. Critical.
6. **Firebase Hosting with config leakage** — hosting reveals project ID and API key in static files.