firebase-apk-scanner

To scan an Android APK for Firebase security misconfigurations, provide the target APK file path to the scanner. It automatically extracts Firebase parameters and tests endpoints to detect open databases, storage buckets, and unauthenticated cloud functions.

During a mobile app penetration test, this scanner identifies Firebase vulnerabilities including open databases, exposed storage buckets, and unauthenticated cloud functions. It extracts project IDs, API keys, and endpoints from decompiled APKs to test for data leak risks.

Yes, you need apktool installed to audit a Firebase-backed Android application. The automated vulnerability scanning process relies on apktool to decompile the APK file and extract the Firebase configuration parameters required for endpoint testing.

Yes, you can automatically extract Firebase API keys and project IDs from a decompiled APK. The scanner parses the decompiled application code to locate and pull Firebase configuration parameters for subsequent security auditing.

The best way to test Firebase authentication endpoints for unauthorized access is using an automated scanner that extracts backend configuration from the APK. It specifically probes these endpoints to verify if cloud functions remain unauthenticated or databases are left open.

Firebase storage buckets are accessible without authentication due to security misconfigurations in backend rules. An APK scanner detects these exposed buckets by extracting the app's Firebase configuration and testing the associated endpoints for open access vulnerabilities.