Detect exposed Firebase API keys and GCP service account credentials in client-side assets.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-firebase
Please help me install this Agent Skill. Skill: hunt-firebase Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-firebase Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-firebase
Firebase and GCP services are frequently misconfigured by developers, leading to critical public exposure of sensitive user data, unauthorized access to cloud resources, and full GCP compromise when API keys or service account credentials are leaked in client-side assets or exposed configuration files.
Use the hunt-firebase skill to scan a target's public web and mobile assets for exposed Firebase API keys and validate if associated Firestore databases are publicly readable.
High-intent search queries and answers about installing and using this skill.
To validate Firebase misconfigurations like public Firestore read access, extract the Firebase API key from the target's client-side assets and attempt to query the associated database directly. This confirms unauthorized data exposure and open access rules quickly.
Firebase misconfigurations that can be exploited using extracted API keys include public Firestore and Realtime Database read or write access, open Firebase Auth sign-up endpoints, and exposed GCP service account keys allowing IAM policy enumeration and privilege escalation.
Yes, this Firebase security testing approach works for mobile app assessments by extracting Firebase API keys and GCP service account credentials from mobile app assets. It targets organizations using Firebase, Firestore, Realtime Database, or GCP cloud infrastructure to validate critical data exposure.
You can use leaked GCP service account JSON keys to enumerate IAM policies and access cloud resources by leveraging the gcloud CLI. This allows testers to export sensitive data and demonstrate full GCP compromise during offensive security engagements.
You should test for Firebase Realtime Database public access when an organization uses Firebase services and exposes API keys in client-side code. Validating these misconfigurations prevents unauthorized data extraction and identifies critical security breaches.
EntroVyxExtract hardcoded credentials and API keys from JavaScript bundles and source maps.
uphiagoExploit misconfigured cloud IAM, serverless, and storage resources across GCP, AWS, and Azure.
manuelbrandner85Scan Android APK files for Firebase security misconfigurations.
Kisilev13Scan AWS, GCP, Azure, and Kubernetes for cloud misconfigurations.
