Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting/pentesting-web/buckets/firebase-database.md
CPol e7afb9504e
GitBook: [master] one page modified
2021-05-26 09:08:21 +00:00

2.8 KiB
Raw Blame History

Firebase Database

What is Firebase

Firebase is a Backend-as-a-Services mainly for mobile application. It is focused on removing the charge of programming the back-end providing a nice SDK as well as many other interesting things that facilitates the interaction between the application and the back-end.

Pentest Methodology

Therefore, some Firebase endpoints could be found in mobile applications. It is possible that the Firebase endpoint used is configured badly grating everyone privileges to read (and write) on it.

This is the common methodology to search and exploit poorly configured Firebase databases:

  1. Get the APK of app you can use any of the tool to get the APK from the device for this POC. You can use “APK Extractor” https://play.google.com/store/apps/details?id=com.ext.ui&hl=e
  2. Decompile the APK using apktool, follow the below command to extract the source code from the APK.
  3. Go to the res/values/strings.xml and look for this and search for “firebase” keyword
  4. You may find something like this URL “https://xyz.firebaseio.com/”
  5. Next, go to the browser and navigate to the found URL: https://xyz.firebaseio.com/.json
  6. 2 type of responses can appear:
    1. “Permission Denied”: This means that you cannot access it, so it's well configured
    2. “null” response or a bunch of JSON data: This means that the database is public and you at least have read access.
      1. In this case, you could check for writing privileges, an exploit to test writing privileges can be found here: https://github.com/MuhammadKhizerJaved/Insecure-Firebase-Exploit

Interesting note: When analysing a mobile application with MobSF, if it finds a firebase database it will check if this is publicly available and will notify it.

Alternatively, you can use Firebase Scanner, a python script that automates the task above as shown below:

python FirebaseScanner.py -f <commaSeperatedFirebaseProjectNames>

Authenticated

If you have credentials to access the Firebase database you can use a tool such as Baserunner to access more easily the stored information.

References