firebase-apk-scanner

The scanner identifies critical Firebase security flaws within Android applications, including open databases, insecure storage buckets, authentication issues, and exposed cloud functions, preventing unauthorized data access and potential breaches.

Yes, you can audit Android apps for exposed Firebase storage buckets and open databases. The scanner inspects the APK file structure to locate and report these specific endpoint security weaknesses with detailed remediation steps.

Yes, apktool is required as a dependency to deconstruct and analyze the APK file. It works alongside curl and grep to extract Firebase endpoints and identify security flaws within the Android application package.

The best way to find exposed cloud functions is using an automated APK scanner designed for Firebase audits. It systematically extracts and tests Firebase endpoints to detect exposed functions and authentication issues.

A primary limitation is that testing Firebase endpoint security requires authorized access for legitimate security research. The scanner relies on static APK analysis via apktool, meaning obfuscated endpoints might limit vulnerability detection.