wufufu770 TL;DR
- 目的：Perform firebase apk scanner assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in t
- 适用：通用
- 输入：目标信息
- 输出：执行结果 + 证据
- 红线：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
- 关联：上游：003-src-session-start → 下游：003-src-session-start（按需调用）
Scan Summary
| Metric | Value |
|---|---|
| APKs Scanned | X |
| Vulnerable | X |
| Total Issues | X |
Extracted Configuration
| Field | Value |
|---|---|
| Project ID | extracted_value |
| Database URL | extracted_value |
| Storage Bucket | extracted_value |
| API Key | extracted_value |
| Auth Domain | extracted_value |
Vulnerabilities Found
| Severity | Issue | Evidence |
|---|---|---|
| CRITICAL | Description | Brief evidence |
| HIGH | Description | Brief evidence |
Remediation
Provide specific fixes for each vulnerability found. Reference the Vulnerability Patterns for secure code examples.
Manual Testing (If Scanner Fails)
If the scanner script is unavailable or fails, perform manual extraction and testing:
Extract Configuration
Search for Firebase config in decompiled APK:
# Decompile
apktool d -f -o ./decompiled $ARGUMENTS
# Find google-services.json
find ./decompiled -name "google-services.json"
# Search XML resources
grep -r "firebaseio.com\|appspot.com\|AIza" ./decompiled/res/
# Search assets (hybrid apps)
grep -r "firebaseio.com\|AIza" ./decompiled/assets/
Test Endpoints
Once you have the PROJECT_ID and API_KEY:
Authentication:
# Test open signup
curl -s -X POST -H "Content-Type: application/json" \
-d '{"email":"test@test.com","password":"Test123!","returnSecureToken":true}' \
"https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY"
# Test anonymous auth
curl -s -X POST -H "Content-Type: application/json" \
-d '{"returnSecureToken":true}' \
"https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY"
Database:
# Realtime Database read
curl -s "https://PROJECT_ID.firebaseio.com/.json"
# Firestore read
curl -s "https://firestore.googleapis.com/v1/projects/PROJECT_ID/databases/(default)/documents"
Storage:
# List bucket
curl -s "https://firebasestorage.googleapis.com/v0/b/PROJECT_ID.appspot.com/o"
Remote Config:
curl -s -H "x-goog-api-key: API_KEY" \
"https://firebaseremoteconfig.googleapis.com/v1/projects/PROJECT_ID/remoteConfig"
Severity Classification
- CRITICAL: Unauthenticated database read/write, storage write, open signup on private apps
- HIGH: Anonymous auth enabled, storage bucket listing, collection enumeration
- MEDIUM: Email enumeration, accessible cloud functions, remote config exposure
- LOW: Information disclosure without sensitive data
Important Guidelines
- Authorization required - Only scan APKs you have permission to test
- Clean up test data - The scanner automatically removes test entries it creates
- Save tokens - If anonymous auth succeeds, use the token for authenticated bypass testing
- Test all regions - Cloud Functions may be deployed to us-central1, europe-west1, asia-east1, etc.
- Multiple instances - Some apps use multiple Firebase projects; test all discovered configurations
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)