hunt-firebase

What problem does it solve?

Firebase and GCP services are frequently misconfigured by developers, leading to critical public exposure of sensitive user data, unauthorized access to cloud resources, and full GCP compromise when API keys or service account credentials are leaked in client-side assets or exposed configuration files.

Core Features & Use Cases

• Firebase Asset Discovery: Locates Firebase API keys in JS bundles, source maps, .env files, and public config endpoints, plus identifies Firebase service endpoints across target infrastructure.
• Multi-Service Exploitation: Tests and exploits misconfigurations in Firestore, Realtime Database, Firebase Storage, Firebase Auth, and GCP IAM to extract data, gain write access, or escalate privileges.
• GCP Service Account Abuse: Leverages leaked GCP service account JSON keys to enumerate IAM policies, access cloud resources, and export sensitive data via gcloud CLI.
• Use Case: A penetration tester assessing a healthcare mobile app can use this skill to extract a Firebase API key from the app's JS bundle, then dump all public Firestore collections containing patient PII to demonstrate a critical data breach.

Quick Start

Use the hunt-firebase skill to scan a target's public web and mobile assets for exposed Firebase API keys and validate if associated Firestore databases are publicly readable.