skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-firebase

Automate discovery and exploitation of misconfigured Firebase and Google Cloud Platform services.

3|1|Updated Jul 2, 2026
Search Tags:#reconnaissance#exploitation#pentesting#firebase#firestore#cloud-security
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-firebase-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-firebase
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-firebase
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-firebase-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of exposed Firebase API keys and misconfigured security rules that lead to unauthorized data access and potential full-scale database breaches.

Core Features & Use Cases

  • Automated Reconnaissance: Scans JS bundles, source maps, and configuration files to identify Firebase API keys and project endpoints.
  • Exploitation Workflows: Provides structured methods to test Firestore, Realtime Database, and Storage for public read/write access.
  • Use Case: When a penetration tester discovers a Firebase API key in a client-side JS bundle, this skill automates the process of verifying if the Firestore database is publicly accessible and dumping the contents to demonstrate impact.

Quick Start

Use the hunt-firebase skill to scan the target domain for exposed API keys and test for public Firestore database access.

Frequently Asked Questions about hunt-firebase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Firestore databases for public read and write access?▼

To test Firestore databases for public access, you can automate REST API probes against the identified project endpoints to verify insecure security rules and extract database contents. This reveals unauthorized data exposure.

How do I find exposed Firebase API keys in JavaScript bundles?▼

Finding exposed Firebase API keys involves scanning client-side JavaScript bundles, source maps, and configuration files to identify project endpoints. This reconnaissance uncovers credentials leaking in front-end code.

What tools do I need to exploit Firebase misconfigurations from the command line?▼

Exploiting Firebase misconfigurations requires standard command-line tools including curl, grep, and python3. These tools execute REST API probes and extract data from vulnerable Google Cloud Platform services.

Can I check Realtime Database security rules for unauthorized access during pentesting?▼

Yes, you can check Realtime Database security rules for unauthorized access by running structured exploitation workflows. This tests public read and write permissions to demonstrate database breach impact.

What is the risk of leaked Firebase service account credentials in mobile backends?▼

Leaked Firebase service account credentials in mobile backends present a critical security risk leading to unauthorized data access and full-scale database breaches. Exposed API keys enable attackers to bypass security rules.

Does this Firebase exploitation approach work for Google Cloud Platform services?▼

Yes, this Firebase exploitation approach works for Google Cloud Platform services by automating the discovery and exploitation of misconfigured Firestore, Realtime Database, and Storage endpoints across web and mobile backends.

Related Skills

Explore More Software Engineering Skills→
SuperlendSuperlend

firebase-apk-scanner

Detect Firebase security misconfigurations in Android APKs.

Official
Advanced
EmasoftEmasoft
13

amoa-verification-patterns

Generate evidence-based JSON verification reports for implemented code and systems.

Community
Advanced
xalgordxalgord
846

firebase-firestore

Identify and remediate Firebase security misconfigurations in Firestore, Realtime Database, and Cloud Functions.

Community
Advanced
2nth-ai2nth-ai
1

tech/google/cloud/security

Manage GCP security configurations, IAM policies, secrets, and encryption keys.

Official
Advanced