during the static analysis while pentesting an android application I found the following information to connect to a firebase instance.

<string name="google_app_id">1:**REDACTED**:android:**REDACTED**</string>
<string name="google_api_key">AIza**REDACTED**</string>
<string name="firebase_database_url">https://**REDACTED**.firebaseio.com</string>
<string name="gcm_defaultSenderId">**REDACTED**</string>
<string name="google_storage_bucket">**REDACTED**.appspot.com</string>
<string name="project_id">**REDACTED**-staging</string>

The application does not use Firebase authentication for users, and this instance should just be used to retrieve some non-user generic data.

My question is, would it makes sense to try and interact with this Firebase instance to check if it's properly configured (ex. if it really is read-only)

If the answer is yes, are there some tools commonly used for this task?

Thank you.

  • 1
    You have the endpoint, and the credentials. You can answer that.
    – ThoriumBR
    Sep 20 '21 at 0:09
  • Obviously it's possible, since the app does it. There's nothing magical about Android apps as opposed to any other client code. Worst case, you pull the SDK from Google and write your own app using those credentials... but it probably makes more sense to try them with the FB console, or with one of the many client libraries including for scripting languages... or just use the REST API...
    – CBHacking
    Sep 20 '21 at 6:30
  • Thank you for your feedback. Yes, I realized that it should be possible. I'm asking if someone knows a tool test firebase. I've tried to connect to firebase using both REST api and Pyrebase[github.com/thisbejim/Pyrebase] but I always get "Requests from this Android client application empty are blocked."
    – D.Rek
    Sep 20 '21 at 8:10
  • It's because you are sending empty requests. Run the application over an intercepting proxy and you can get the full requests. Then you can change them and even predict what the application will send.
    – ThoriumBR
    Sep 20 '21 at 16:55
  • I already tried that, I'm able to see all the requests beside the one used to obtain the code. P.S. I also used various Frida scripts to do ssl unpinning without anyluck, that's why I was searching for some alternative ways.
    – D.Rek
    Sep 20 '21 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.