Firebase-Extractor

Firebase-Extractor //Mobile OSINT// Esta herramienta está escrita en Python2, su propósito es analizar todos los resultados de la búsqueda de Bing. Básicamente, cada vez que se encuentra una URL de FirebaseIO para una aplicación, el usuario, en lugar de buscar datos sensibles manualmente a través...

firebaseExploiter

不安全的 Firebase CLI 扫描器与利用工具。 功能 • 安装 • 用法 功能 从主机列表进行批量漏洞扫描 在利用期间上传自定义 exploit.json 中的 JSON 数据 为利用自定义 URI 路径 用法 这将显示 CLI 工具的帮助信息。以下为其支持的所有必需参数。 安装 FirebaseExploiter 使用 go1.19 构建。请确保使用最新版本的 Go 以成功安装。运行以下命令安装最新版本： root@kitploit: go install -v github.com/securebinary/firebaseExploiter@latest 运行...

Malware-Exhibit

⚠️⚠️ Malware-Exhibit ⚠️⚠️ Docker - Uso e importancia Extrae la imagen de docker en Información; no uses este repositorio en tu propio ordenador ni lo clones para construir el dockerfile en tu propia máquina Para ejecutar la imagen usa, p. ej.: ---docker run --name -it...

baserunner

Baserunner A tool for exploring and exploiting Firebase datastores. See this post on our blog for an overview of how Firebase works and why we developed this tool. Set up 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. Go to...

baserunner

Baserunner Una herramienta para explorar y explotar almacenes de datos de Firebase. Consulte esta publicación en nuestro blog para obtener una visión general de cómo funciona Firebase y por qué desarrollamos esta herramienta. Configuración 1. git clone https://github.com/iosiro/baserunner.git 2. ...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

FireShodanMap

FireShodanMap FireShodanMap 是一个实时地图，集成了 Firebase 和 Shodan。通过 Shodan 搜索易受攻击的设备，并将其显示在地图上以供分析。所有在 Firebase 中更新的数据都是实时的。 变更 我们有一个名为 "fireshodan.py" 的文件，负责填充 Firebase 数据库，我们需要修改： root@kitploit: + FILEWITHKEY.json （打开“凭据”标签页，点击创建凭据 。选择 API 密钥选项。创建服务器密钥。它将自动下载为一个 .json 文件） + KEYFIREBASEHERE （打开 Firebas...

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel History This bot adopted special for deploying to Heroku General purposes of this got - "Be helpful for infosec community!" Bot use https://github.com/maddevsio/bbcrawler for fetching information Used heroku...

telegram_bbbot

telegrambbbot Telegram 漏洞赏金机器人 https://telegram.me/bugbountychannel 历史 该机器人专为部署到 Heroku 而改编 本机器人的总体目标是——“为信息安全社区提供帮助！” 机器人使用 https://github.com/maddevsio/bbcrawler 获取信息 使用 heroku 的 https://github.com/heroku/go-getting-started 作为项目模板 机器人使用了 heroku.com 和 firebase.com 的免费账户 目的 机器人的目的： “尽快传递信息！”...

firebase

firebase 利用存在漏洞或配置错误的 Firebase 数据库 免责声明：提供的软件仅用于教育目的。请自行决定使用，创建者对造成的任何损害概不负责。请负责任地使用！ 前置条件 非标准 Python 模块： dnsdumpster bs4 requests 安装 如果以下命令成功运行，你就可以使用该脚本了： root@kitploit: git clone https://github.com/Turr0n/firebase.git cd firebase pip install -r requirements.txt 用法 root@kitploit: python3...

CVE-2026-13447

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447

The MStore API WordPress plugin (versions ≤ 4.20.0) is vulnerable to an unauthenticated authentication bypass via JWT forgery. The root cause lies in FirebasePhoneAuthHelper::verify_id_token(), which validates Firebase ID token claims (alg, kid, aud, iss) but never verifies the JWT cryptographic ...

EUVD-2026-71838

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

PT-2026-86308

Name of the Vulnerable Software and Affected Versions Mstore Api plugin for WordPress versions prior to 4.20.1 Description An authentication bypass exists due to JWT JSON Web Token forgery. The issue occurs in the FirebasePhoneAuthHelper::verify id token function, which validates token claims suc...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

MAL-2026-15534 Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...