firebase-apk-scanner

To scan an APK for Firebase security misconfigurations, provide the APK file or directory path to the built-in Bash scanner, which decompiles it with apktool, extracts Firebase configuration, tests data access, and outputs text and JSON reports.

A mobile security pentest checks Firebase services by enumerating Authentication rules, Realtime Database, Firestore, Storage, Cloud Functions, and Remote Config to identify data access vulnerabilities and report findings for remediation.

You can extract Firebase configuration from an APK without root access by decompiling the application package with apktool, which reveals embedded Firebase configuration sources for authorized security assessments and compliance reviews.

The Firebase APK scanner tests authentication and database rules by extracting configuration from decompiled sources and actively probing data access permissions to detect security misconfigurations in Firebase-backed mobile apps.

Firebase security audit reports are generated in both text and JSON formats, providing structured findings on authentication, data access, and resource enumeration for security auditing and remediation tracking.

You need apktool installed to scan Android APKs for Firebase vulnerabilities because the Bash-based scanner relies on it to decompile the application package and extract embedded Firebase configuration sources.