Firebase Pentest Toolkit & Exploit PoCs

A comprehensive toolkit for auditing, enumerating, and exploiting misconfigurations in Firebase, Cloud Firestore, and Next.js stacks.

---

Overview

While evaluating a target event registration platform (Next.js + Firebase Auth + Cloud Firestore), I uncovered multiple critical vulnerabilities resulting from improper client-side trust, Missing Authorization (BOLA), and lack of Field-Level security rules.

This repository serves two purposes:

1. Documenting the mechanics of the 6 vulnerability classes discovered (Zero-Cost Bypass, BOLA, Privilege Escalation).
2. Providing a generalized, reusable toolkit of scripts (extractors, dumpers, and PoCs) that security researchers and bug bounty hunters can use to audit other Firebase/Firestore targets.

Disclaimer: This toolkit and the accompanying Proof-of-Concepts (PoCs) are published for educational and authorized auditing purposes only. Do not use these tools against systems you do not own or do not have explicit permission to test.

---

The Toolkit (Use on any Firebase Target)

This toolkit includes generalized scripts built to interact with standard Firebase APIs. You only need the target's Web API Key and Project ID (which are always public in Firebase apps) to use these tools.

1. Database Enumerators (/scripts)

Firestore often has misconfigured security rules (allow read: if true). These scripts automate the extraction of entire databases if read access is globally permitted.

• firestore_collection_dump.js - Connects to the REST API and dumps known collection names into a structured JSON file.
• firestore_to_excel.js - Converts the dense JSON dump into a clean, multi-sheet Excel file for easy analysis and filtering.

2. Browser Exploits (/browser-exploits)

Firebase persists active JWT user sessions in IndexedDB.

• session_token_extractor.js - Paste this in Chrome DevTools to extract the long-lived refresh_token and uid.
• session_injector.js - Paste this in an unauthenticated browser. It fetches a fresh id_token using the refresh token and directly injects it into IndexedDB, granting full account takeover without a password or MFA.

3. Exploitation PoCs (/poc)

Skeleton scripts demonstrating how to send raw PATCH requests against the Firestore REST API to evaluate write-access rule flaws.

• v2_unauthenticated_write.js - Tests if collections allow unauthenticated writes.
• v3_privilege_escalation.js - Tests Field-Level BOLA by attempting to overwrite the role field on a user's own document.

---

Case Study: The 6 Vulnerabilities Found

The initial target audit yielded the following findings. The issues have since been disclosed and patched by the vendor.

ID	Vulnerability Class	Severity	Impact
V1	Payment Amount Manipulation	Critical	Client-supplied pricing was trusted, allowing payments to be generated for $0.01 instead of $50.00.
V2	Unauthenticated Firestore Writes	Critical	Allowed forging of internal payment "SUCCESS" transaction documents without any authentication.
V3	Privilege Escalation (Field BOLA)	High	Missing Field-Level rules allowed an authorized user to change their own role property to admin.
V4	Object-Level BOLA	High	Allowed an authenticated user to overwrite the profile data and permissions of other users.
V5	Frontend State Spoofing	Medium	URL parameters dictated UI state (e.g., /success?orderId=123), bypassing backend validation layers.
V6	Exposed Long-Lived Refresh Tokens	Medium	Enabled offline session token extraction and cross-device injection.

The full, detailed writeups for reproducing these specific findings can be found in docs/vulnerability-writeups.md.

---

Getting Started with the Scripts

1. Clone the repository:

   git clone https://github.com/YOUR_USERNAME/firebase-pentest-kit.git
   cd firebase-pentest-kit

2. Install dependencies:

   npm install node-fetch xlsx

3. Edit the CONFIG block at the top of any script in /scripts or /poc to include your target's PROJECT_ID and API_KEY (found in the target's frontend JavaScript bundle).
4. Run the script:

   node scripts/firestore_collection_dump.js

---

Responsible Disclosure Timeline

• March 02, 2026 - Initial Reconnaissance & Discovery started.
• March 03, 2026 - Critical Vulnerabilities confirmed and PoCs built.
• March 03, 2026 - Detailed security report dispatched to the target organization's development team.
• March 06, 2026 - V1 through V4 confirmed patched and mitigated by developers.
• April 02, 2026 - 30-Day Public Disclosure. Sanitized toolkit and generalized methodology released.

---

Created by Security Researcher.