firebase-apk-scanner

To scan an Android APK for Firebase security misconfigurations, provide the APK file or directory to the scanner. It decompiles the APK with apktool, extracts Firebase configuration data, and tests for open sign-up, anonymous auth, and unauthenticated access.

During an APK audit, you can detect Firebase security issues like open sign-ups, anonymous authentication, unauthenticated access, and misconfigurations in Realtime Database, Firestore, Storage, and Cloud Functions.

Yes, you can test Cloud Functions and Remote Config exposure from an APK. The scanner enumerates and tests these services by extracting their configuration data during the decompilation process.

Firebase penetration testing reports are generated in both text and JSON formats. These comprehensive reports document the extracted misconfigurations and authentication weaknesses to support remediation and compliance efforts.

Yes, the scanner requires apktool to decompile APKs for Firebase analysis. It uses apktool to unpack the Android application package and extract the Firebase configuration data needed to test for security vulnerabilities.

Yes, this Firebase scanner is specifically designed for authorized security testing and mobile app security audits. It identifies misconfigurations in Firebase-backed apps to support secure app deployments and compliance.