firebase-supabase-attack

What problem does it solve?

This Skill solves the problem of identifying and exploiting publicly accessible Firebase and Supabase backend services that lack proper access controls, which are a leading source of large-scale data breaches in modern web applications using Backend-as-a-Service platforms.

Core Features & Use Cases

• Extracts Firebase and Supabase configuration credentials from JavaScript bundles and source code leaks to identify target backend instances.
• Tests for public access to Firestore databases, Cloud Storage buckets, and Authentication endpoints for Firebase, and enumerates Supabase REST API tables, tests CRUD operations, and checks for open signup flows when Row Level Security is misconfigured.
• Use Case: For a target delivery platform using Firebase, this Skill can confirm if 200,000+ customer conversation records, store data, and audio files are publicly readable without authentication, as validated in real-world pentest engagements.

Quick Start

Use the firebase-supabase-attack skill to probe a target domain for exposed Firebase or Supabase backend data after extracting the platform configuration from the site's JavaScript bundles.