GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

MAL-2026-4509 Malicious code in celonix-otp-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df58532b5edb3f7a5ad9734a7f4fa46f062c0f220d578db42a223188d078d9bb The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Database URL...

Firebase Realtime Database — public REST access

GET /.json?shallow=true on the Realtime Database root to see if rules allow unauthenticated reads. Optionally PUT+GET+DELETE a random key when probewrite is enabled only on assets you are authorized to test. !/usr/bin/env python3 -- coding: utf-8 -- """ Inspired by FireSploit Shubham Sharma: RTDB...

AST-2007-027 - Database matching order permits host-based authentication to be ignored

Asterisk Project Security Advisory - AST-2007-027 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Database matching order permits host-based | | | authenticatio...