Is it safe to use on any app?

This skill should only be used on applications you have explicit authorization to test. Performing security scans on third-party apps without permission may be illegal.

Can this skill scan iOS apps?

No, this specific skill is designed exclusively for Android APK files and utilizes APK-specific tools like apktool for decompilation and analysis.

Does it require the original source code?

No, the skill works directly with compiled APK files by decompiling them to extract Firebase configurations, endpoint URLs, and API keys.

What types of Firebase vulnerabilities does it detect?

It detects unauthenticated read/write access to Realtime Database and Firestore, public Storage buckets, open user registration, and exposed Cloud Functions.

Firebase APK Security Scanner

Name: Firebase APK Security Scanner
Author: fjor1025

byfjor1025

0•

Security & Testing

Audits Android APK files for Firebase security vulnerabilities and misconfigurations including exposed databases and storage buckets.

The Firebase APK Security Scanner is a specialized tool for security analysts and mobile developers to identify critical vulnerabilities within Android applications using Firebase backends. By decompiling APKs and extracting configurations, the skill automatically tests for unauthenticated database access, open Cloud Storage buckets, insecure authentication settings, and exposed Cloud Functions. It provides comprehensive reports with severity classifications and remediation steps, making it an essential asset for performing thorough mobile app security audits and ensuring data protection in production environments.

Key Features

01Automated APK decompilation and Firebase configuration extraction

02Enumeration and testing of exposed Firebase Cloud Functions

03Authentication audit for open signup, anonymous auth, and email enumeration

04Security testing for Realtime Database, Firestore, and Cloud Storage

050 GitHub stars

06Detailed report generation with severity rankings and remediation guidance

Use Cases

01Performing security audits on Android applications before production deployment

02Identifying leaked PII or sensitive business data in publicly accessible Firebase instances

03Testing the effectiveness of Firebase security rules and authentication restrictions

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework firebase-apk-scanner

For use in Claude.ai and ChatGPT

Download Skill