mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 15:37:53 -08:00
104 lines
6.5 KiB
Markdown
104 lines
6.5 KiB
Markdown
# GCP - Firebase Enum
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
## [Firebase](https://cloud.google.com/sdk/gcloud/reference/firebase/)
|
||
|
||
The Firebase Realtime Database is a cloud-hosted NoSQL database that lets you store and sync data between your users in realtime. [Learn more](https://firebase.google.com/products/realtime-database/).
|
||
|
||
### Unauthenticated Enum
|
||
|
||
Some **Firebase endpoints** could be found in **mobile applications**. It is possible that the Firebase endpoint used is **configured badly grating everyone privileges to read (and write)** on it.
|
||
|
||
This is the common methodology to search and exploit poorly configured Firebase databases:
|
||
|
||
1. **Get the APK** of app you can use any of the tool to get the APK from the device for this POC.\
|
||
You can use “APK Extractor” [https://play.google.com/store/apps/details?id=com.ext.ui\&hl=e](https://hackerone.com/redirect?signature=3774f35d1b5ea8a4fd209d80084daa9f5887b105\&url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.ext.ui%26hl%3Den)
|
||
2. **Decompile** the APK using **apktool**, follow the below command to extract the source code from the APK.
|
||
3. Go to the _**res/values/strings.xml**_ and look for this and **search** for “**firebase**” keyword
|
||
4. You may find something like this URL “_**https://xyz.firebaseio.com/**_”
|
||
5. Next, go to the browser and **navigate to the found URL**: _https://xyz.firebaseio.com/.json_
|
||
6. 2 type of responses can appear:
|
||
1. “**Permission Denied**”: This means that you cannot access it, so it's well configured
|
||
2. “**null**” response or a bunch of **JSON data**: This means that the database is public and you at least have read access.
|
||
1. In this case, you could **check for writing privileges**, an exploit to test writing privileges can be found here: [https://github.com/MuhammadKhizerJaved/Insecure-Firebase-Exploit](https://github.com/MuhammadKhizerJaved/Insecure-Firebase-Exploit)
|
||
|
||
**Interesting note**: When analysing a mobile application with **MobSF**, if it finds a firebase database it will check if this is **publicly available** and will notify it.
|
||
|
||
Alternatively, you can use [Firebase Scanner](https://github.com/shivsahni/FireBaseScanner), a python script that automates the task above as shown below:
|
||
|
||
```bash
|
||
python FirebaseScanner.py -f <commaSeperatedFirebaseProjectNames>
|
||
```
|
||
|
||
### Authenticated Enum
|
||
|
||
If you have credentials to access the Firebase database you can use a tool such as [**Baserunner**](https://github.com/iosiro/baserunner) to access more easily the stored information. Or a script like the following:
|
||
|
||
```python
|
||
#Taken from https://blog.assetnote.io/bug-bounty/2020/02/01/expanding-attack-surface-react-native/
|
||
#Install pyrebase: pip install pyrebase4
|
||
import pyrebase
|
||
|
||
config = {
|
||
"apiKey": "FIREBASE_API_KEY",
|
||
"authDomain": "FIREBASE_AUTH_DOMAIN_ID.firebaseapp.com",
|
||
"databaseURL": "https://FIREBASE_AUTH_DOMAIN_ID.firebaseio.com",
|
||
"storageBucket": "FIREBASE_AUTH_DOMAIN_ID.appspot.com",
|
||
}
|
||
|
||
firebase = pyrebase.initialize_app(config)
|
||
|
||
db = firebase.database()
|
||
|
||
print(db.get())
|
||
```
|
||
|
||
To test other actions on the database, such as writing to the database, refer to the Pyrebase4 documentation which can be found [here](https://github.com/nhorvath/Pyrebase4).
|
||
|
||
### Access info with APPID and API Key <a href="#access-info-with-appid-and-api-key" id="access-info-with-appid-and-api-key"></a>
|
||
|
||
If you decompile the iOS application and open the file `GoogleService-Info.plist` and you find the API Key and APP ID:
|
||
|
||
* API KEY **AIzaSyAs1\[...]**
|
||
* APP ID **1:612345678909:ios:c212345678909876**
|
||
|
||
You may be able to access some interesting information
|
||
|
||
**Request**
|
||
|
||
`curl -v -X POST "https://firebaseremoteconfig.googleapis.com/v1/projects/612345678909/namespaces/firebase:fetch?key=AIzaSyAs1[...]" -H "Content-Type: application/json" --data '{"appId": "1:612345678909:ios:c212345678909876", "appInstanceId": "PROD"}'`
|
||
|
||
## References <a href="#references" id="references"></a>
|
||
|
||
* [https://blog.securitybreached.org/2020/02/04/exploiting-insecure-firebase-database-bugbounty/](https://blog.securitybreached.org/2020/02/04/exploiting-insecure-firebase-database-bugbounty/)
|
||
* [https://medium.com/@danangtriatmaja/firebase-database-takover-b7929bbb62e1](https://medium.com/@danangtriatmaja/firebase-database-takover-b7929bbb62e1)
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|