Firebase-Extractor

Firebase-Extractor //Mobile OSINT// Esta herramienta está escrita en Python2, su propósito es analizar todos los resultados de la búsqueda de Bing. Básicamente, cada vez que se encuentra una URL de FirebaseIO para una aplicación, el usuario, en lugar de buscar datos sensibles manualmente a través...

firebaseExploiter

Escáner y Exploit CLI para Firebase Inseguro. Características • Instalación • Uso Características Escaneo masivo de vulnerabilidades desde una lista de hosts Datos JSON personalizados en exploit.json para cargar durante el exploit Ruta URI personalizada para el exploit Uso...

Malware-Exhibit

⚠️⚠️ Malware-Exhibit ⚠️⚠️ Docker - Usage and Importance Pull the docker image In Information, do not use this repository on your own computer or clone the repository and build the dockerfile on your down computer To run the image use ie: ---docker run --name -it...

baserunner

Baserunner A tool for exploring and exploiting Firebase datastores. See this post on our blog for an overview of how Firebase works and why we developed this tool. Set up 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. Go to...

baserunner

Baserunner Una herramienta para explorar y explotar almacenes de datos de Firebase. Consulte esta publicación en nuestro blog para obtener una visión general de cómo funciona Firebase y por qué desarrollamos esta herramienta. Configuración 1. git clone https://github.com/iosiro/baserunner.git 2. ...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

FireShodanMap

FireShodanMap FireShodanMap es un mapa en tiempo real que integra Firebase y Shodan. Se realiza una búsqueda utilizando Shodan para encontrar dispositivos vulnerables y se muestran en el mapa para su análisis. Todos los datos actualizados en Firebase son en tiempo real. Cambios Tenemos un archivo...

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel History This bot adopted special for deploying to Heroku General purposes of this got - "Be helpful for infosec community!" Bot use https://github.com/maddevsio/bbcrawler for fetching information Used heroku...

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel Historial Este bot fue adaptado especialmente para su despliegue en Heroku El propósito general de este bot es "¡Ser útil para la comunidad de infosec!" El bot utiliza https://github.com/maddevsio/bbcrawler para obtener...

firebase

firebase Explotando bases de datos Firebase vulnerables o mal configuradas Aviso legal: El software proporcionado es solo para fines educativos. Úselo bajo su propio criterio, el creador no se hace responsable de los daños causados. Por favor, ¡úsalo de manera responsable! Requisitos previos...

CVE-2026-13447

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447

The MStore API WordPress plugin (versions ≤ 4.20.0) is vulnerable to an unauthenticated authentication bypass via JWT forgery. The root cause lies in FirebasePhoneAuthHelper::verify_id_token(), which validates Firebase ID token claims (alg, kid, aud, iss) but never verifies the JWT cryptographic ...

EUVD-2026-71838

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

PT-2026-86308

Name of the Vulnerable Software and Affected Versions Mstore Api plugin for WordPress versions prior to 4.20.1 Description An authentication bypass exists due to JWT JSON Web Token forgery. The issue occurs in the FirebasePhoneAuthHelper::verify id token function, which validates token claims suc...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

MAL-2026-15534 Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...

CVE-2026-15985

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...