HUNT-FIREBASE — Firebase / Firestore / GCP Exploitation

Crown Jewel Targets

Firebase is Google's mobile/web platform. When developers embed the API key in the client (which is required by Firebase SDKs), they often forget to configure Firestore Security Rules or Realtime Database Rules, leaving all data publicly readable and writable.

Highest-value findings:

1. Public Firestore Database — anon key allows read/write to ALL collections → full data dump (users, messages, PII). Critical.
2. Public Realtime Database — {database}.firebaseio.com/.json returns all data without auth. Critical.
3. Firebase Storage with public read — storage bucket allows anonymous file listing and download. Critical.
4. Firebase signUp open — anyone can create an auth account, then use the JWT to access Firestore. High.
5. Service Account JSON leaked — full GCP IAM access to Firestore, Storage, Cloud Functions, IAM policy. Critical.
6. Firebase Hosting with config leakage — hosting reveals project ID and API key in static files.

Phase 1 — Find the Firebase Project

Firebase is identified by its API key format: AIzaSy[0-9A-Za-z_-]{35}