3 ms·
Speaking of, are there tools to audit/explore firebase/firestore databases i.e. see if collections/documents are readable? I imagine a web tool that could take
by gregsadetsky 3y ago
Speaking of, are there tools to audit/explore firebase/firestore databases i.e. see if collections/documents are readable?
I imagine a web tool that could take the app id and other api values (that are publicly embedded in frontend apps), optionally support a session id (for those firestore apps that use a lightweight “only visible to logged in users” security rule) and accept names of collections (found in the js code) to explore?
- saligrama 3y agoBaserunner [1] does exactly this. I described using it for Firebase security research in my blog post [2]. [1] https://github.com/iosiro/baserunner https://github.com/iosiro/baserunner [2] https://saligrama.io/blog/post/firebase-insecure-by-default/ https://saligrama.io/blog/post/firebase-insecure-by-default/