GCP Firebase Realtime Database - Cloud Enumeration

ID: gcp-firebase-rtdb-enum

Severity: info

Author: initstring

Tags: enum,cloud,cloud-enum,gcp

Description

Searches for Firebase Realtime Databases in GCP.

YAML Source

id: gcp-firebase-rtdb-enum

info:
  name: GCP Firebase Realtime Database - Cloud Enumeration
  author: initstring
  severity: info
  description: |
    Searches for Firebase Realtime Databases in GCP.
  metadata:
    verified: true
    max-request: 1
  tags: enum,cloud,cloud-enum,gcp

self-contained: true

variables:
  BaseDNS: "firebaseio.com"

http:
  - raw:
      - |
        GET https://{{wordlist}}.{{BaseDNS}}/.json HTTP/1.1
        Host: {{wordlist}}.{{BaseDNS}}

    redirects: false

    attack: batteringram
    threads: 10

    matchers-condition: or
    matchers:
      - type: status
        name: "Open GCP Firebase RTDB"
        status:
          - 200

      - type: status
        name: "Protected GCP Firebase RTDB"
        status:
          - 401

      - type: status
        name: "Payment GCP on Google Firebase RTDB"
        status:
          - 402

      - type: status
        name: "Deactivated GCP Firebase RTDB"
        status:
          - 423
# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/enum/gcp-firebase-rtdb-enum.yaml"

View on Github