domains / families / security / firebase-apk-scanner

firebase-apk-scanner

separate

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.

When to use

• Auditing Android applications for Firebase security misconfigurations
• Testing Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
• Checking authentication security (open signup, anonymous auth, email enumeration)
• Enumerating Cloud Functions and testing for unauthenticated access
• Mobile app security assessments involving Firebase backends
• Authorized penetration testing of Firebase-backed applications

When not to use

• Scanning apps you do not have explicit authorization to test
• Testing production Firebase projects without written permission
• When you only need to extract Firebase config without testing (use manual grep/strings instead)
• For non-Android targets (iOS, web apps) - this skill is APK-specific
• When the target app does not use Firebase

Skill page

Source