FireShodanMap

FireShodanMap FireShodanMap 是一个实时地图，集成了 Firebase 和 Shodan。通过 Shodan 搜索易受攻击的设备，并将其显示在地图上以供分析。所有在 Firebase 中更新的数据都是实时的。 变更 我们有一个名为 "fireshodan.py" 的文件，负责填充 Firebase 数据库，我们需要修改： + FILEWITHKEY.json （打开“凭据”标签页，点击创建凭据 。选择 API 密钥选项。创建服务器密钥。它将自动下载为一个 .json 文件） + KEYFIREBASEHERE （打开 Firebase 项目，点击将 Fireba...

Malware-Exhibit

⚠️⚠️ Malware-Exhibit ⚠️⚠️ Docker - Uso e importancia Extrae la imagen de docker en Información; no uses este repositorio en tu propio ordenador ni lo clones para construir el dockerfile en tu propia máquina Para ejecutar la imagen usa, p. ej.: ---docker run --name -it...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

firebaseExploiter

不安全的 Firebase CLI 扫描器与利用工具。 功能 • 安装 • 用法 功能 从主机列表进行批量漏洞扫描 在利用期间上传自定义 exploit.json 中的 JSON 数据 为利用自定义 URI 路径 用法 这将显示 CLI 工具的帮助信息。以下为其支持的所有必需参数。 安装 FirebaseExploiter 使用 go1.19 构建。请确保使用最新版本的 Go 以成功安装。运行以下命令安装最新版本： go install -v github.com/securebinary/firebaseExploiter@latest 运行 FirebaseExploiter...

baserunner

Baserunner A tool for exploring and exploiting Firebase datastores. See this post on our blog for an overview of how Firebase works and why we developed this tool. Set up 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. Go to...

baserunner

Baserunner 用于探索和利用 Firebase 数据存储的工具。请参阅我们博客上的这篇文章，了解 Firebase 的工作原理以及我们为何开发此工具。 设置 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. 在浏览器中打开 http://localhost:47710。 使用方法 Baserunner 界面如下所示： 首先，使用配置文本框从您要测试的应用中加载 Firebase 配置 JSON...

Firebase-Extractor

Firebase-Extractor //移动OSINT// 该工具使用Python2编写，目的是解析Bing搜索的所有结果。基本上，当找到一个应用的firebaseio URL时，用户无需手动浏览搜索结果来寻找敏感数据，而是可以使用此工具。该工具通过将给定的Firebase URL作为Bing搜索引擎的搜索查询，抓取搜索结果的前4页，然后最终解析所有URL以查找敏感关键词。 截图 以下模块被使用： 1.sys 2.requests 3.bs4 // pip install bs4 // 4.urllib2 5.pyfiglet // pip install pyfiglet // 6....

telegram_bbbot

telegrambbbot Telegram Bug Bounty Bot https://telegram.me/bugbountychannel History This bot adopted special for deploying to Heroku General purposes of this got - "Be helpful for infosec community!" Bot use https://github.com/maddevsio/bbcrawler for fetching information Used heroku...

telegram_bbbot

telegrambbbot Telegram 漏洞赏金机器人 https://telegram.me/bugbountychannel 历史 该机器人专为部署到 Heroku 而改编 本机器人的总体目标是——“为信息安全社区提供帮助！” 机器人使用 https://github.com/maddevsio/bbcrawler 获取信息 使用 heroku 的 https://github.com/heroku/go-getting-started 作为项目模板 机器人使用了 heroku.com 和 firebase.com 的免费账户 目的 机器人的目的： “尽快传递信息！”...

firebase

firebase 利用存在漏洞或配置错误的 Firebase 数据库 免责声明：提供的软件仅用于教育目的。请自行决定使用，创建者对造成的任何损害概不负责。请负责任地使用！ 前置条件 非标准 Python 模块： dnsdumpster bs4 requests 安装 如果以下命令成功运行，你就可以使用该脚本了： git clone https://github.com/Turr0n/firebase.git cd firebase pip install -r requirements.txt 用法 python3 firebase.py -h --dnsdumpster -d...

CVE-2026-13447

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447

The MStore API WordPress plugin (versions ≤ 4.20.0) is vulnerable to an unauthenticated authentication bypass via JWT forgery. The root cause lies in FirebasePhoneAuthHelper::verify_id_token(), which validates Firebase ID token claims (alg, kid, aud, iss) but never verifies the JWT cryptographic ...

EUVD-2026-71838

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

PT-2026-86308

Name of the Vulnerable Software and Affected Versions Mstore Api plugin for WordPress versions prior to 4.20.1 Description An authentication bypass exists due to JWT JSON Web Token forgery. The issue occurs in the FirebasePhoneAuthHelper::verify id token function, which validates token claims suc...

CLSA-2026-1788348158 TuxCare security update for firebase/php-jwt (1 CVE)

TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

MAL-2026-15534 Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...