hunt-firebase

name	hunt-firebase
description	Hunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase Hosting detection, GCP service account JSON exploitation, IAM policy enumeration from leaked SA keys. Built from field experience where Firebase API keys in JS bundles unlocked full Firestore read-access on 12+ targets including healthcare platforms and delivery apps. Use when a JS bundle, APK, or .env file reveals a Firebase API key (AIzaSy...) or when target uses firebaseio.com / firestore.googleapis.com endpoints.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
category	redteam
tags	["firebase","hunt","redteam"]

HUNT-FIREBASE — Firebase / Firestore / GCP Exploitation

Crown Jewel Targets

Firebase is Google's mobile/web platform. When developers embed the API key in the client (which is required by Firebase SDKs), they often forget to configure Firestore Security Rules or Realtime Database Rules, leaving all data publicly readable and writable.

Highest-value findings:

1. Public Firestore Database — anon key allows read/write to ALL collections → full data dump (users, messages, PII). Critical.
2. Public Realtime Database — {database}.firebaseio.com/.json returns all data without auth. Critical.
3. Firebase Storage with public read — storage bucket allows anonymous file listing and download. Critical.
4. Firebase signUp open — anyone can create an auth account, then use the JWT to access Firestore. High.
5. Service Account JSON leaked — full GCP IAM access to Firestore, Storage, Cloud Functions, IAM policy. Critical.
6. Firebase Hosting with config leakage — hosting reveals project ID and API key in static files.

---

Phase 1 — Find the Firebase Project

Firebase is identified by its API key format: AIzaSy[0-9A-Za-z_-]{35}

1.1 Search in JS Bundles

# Download the main page and its JS bundles
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET" -o /tmp/index.html
grep -Eo 'src="[^"]*\.js"' /tmp/index.html | cut -d'"' -f2 | while read js; do
  curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET$js" -o "/tmp/$(basename $js)"
done

# Search for Firebase API keys in all downloaded JS
grep -rEn 'AIza[0-9A-Za-z_-]{35}' /tmp/*.js

# Search for firebaseConfig
grep -rEn 'firebaseConfig|firebase.initializeApp|apiKey|authDomain' /tmp/*.js --include="*.js"


grep -rEn  /tmp/*.js --include=


curl --max-time 30 --connect-timeout 10 -sk  | grep -Eo