# FirebaseExploiter | Vulnerability Discovery Tool That Discovers Firebase Database Which Are Open And Can Be Exploitable

**URL:** <https://onehack.st/t/firebaseexploiter-vulnerability-discovery-tool-that-discovers-firebase-database-which-are-open-and-can-be-exploitable/239775>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [October 31, 2023, 7:01pm UTC](https://onehack.st/t/firebaseexploiter-vulnerability-discovery-tool-that-discovers-firebase-database-which-are-open-and-can-be-exploitable/239775 "2023-10-31T19:01:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [October 31, 2023, 7:01pm UTC](https://onehack.st/t/firebaseexploiter-vulnerability-discovery-tool-that-discovers-firebase-database-which-are-open-and-can-be-exploitable/239775/1 "2023-10-31T19:01:00Z")

</div>

#### Insecure Firebase CLI Scanner & Exploit.

[![](https://camo.githubusercontent.com/f5054ffcd4245c10d3ec85ef059e07aacf787b560f83ad4aec2236364437d097/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/securebinary/firebaseExploiter/) [![](https://camo.githubusercontent.com/b35aad6a337642267487516525cc3cc18c4007d38a5826934c0dab55fd5b85ca/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f74686573656375726562696e6172792e7376673f6c6f676f3d74776974746572)](https://twitter.com/thesecurebinary)

[Features](https://github.com/securebinary/firebaseExploiter#features) • [Install](https://github.com/securebinary/firebaseExploiter#installation) • [Usage](https://github.com/securebinary/firebaseExploiter#running-firebaseexploiter)

## Features

[![fileExploit](https://github.com/securebinary/firebaseExploiter/raw/main/static/fileExploit.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/fileExploit.png)

- Mass vulnerability scanning from list of hosts
- Custom JSON data in `exploit.json` to upload during exploit
- Custom `URI path` for exploit

## Usage

[![Usage](https://github.com/securebinary/firebaseExploiter/raw/main/static/usage.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/usage.png)

This will display help for the CLI tool. Here are all the required arguments it supports.

## Installation

FirebaseExploiter was built using go1.19. Make sure you use latest version of [Go](https://go.dev/doc/install) to install successfully. Run the following command to install the latest version:

go install -v [github.com/securebinary/firebaseExploiter@latest](http://github.com/securebinary/firebaseExploiter@latest)

[![Install](https://github.com/securebinary/firebaseExploiter/raw/main/static/install.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/install.png)

## Running FirebaseExploiter

To scan a specific domain to check for Insecure Firebase DB.

[![urlVuln](https://github.com/securebinary/firebaseExploiter/raw/main/static/urlVuln1.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/urlVuln1.png)

[![urlVuln](https://github.com/securebinary/firebaseExploiter/raw/main/static/urlVuln2.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/urlVuln2.png)

To exploit a Firebase DB to write your own JSON document in it.

[![urlExploit](https://github.com/securebinary/firebaseExploiter/raw/main/static/urlExploit.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/urlExploit.png)

Create your own `exploit.json` file in proper JSON format to exploit vulnerable Firebase DBs.

Checking the exploited URL to verify the vulnerability.

[![urlResponse](https://github.com/securebinary/firebaseExploiter/raw/main/static/urlResponse.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/urlResponse.png)

Adding `custom path` for exploiting Firebase DBs.

[![urlPath](https://github.com/securebinary/firebaseExploiter/raw/main/static/urlPath.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/urlPath.png)

Mass scanning for Insecure Firebase Databases from list of target hosts.

[![fileVuln](https://github.com/securebinary/firebaseExploiter/raw/main/static/fileVuln.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/fileVuln.png)

Exploiting vulnerable Firebase DBs from the list of target hosts.

[![fileExploit](https://github.com/securebinary/firebaseExploiter/raw/main/static/fileExploit.png)](https://github.com/securebinary/firebaseExploiter/blob/main/static/fileExploit.png)

## License

`FirebaseExploiter` is made with 🖤 by the `SecureBinary` team. Any tweaks / community contribution are welcome.

## GitHub:

[https://github.com/securebinary/firebaseExploiter](https://github.com/securebinary/firebaseExploiter)