Back to Library

Exposed Firebase Databases

Finds publicly accessible Firebase Realtime Database JSON endpoints that may expose user data and application records.

Beginner Friendly
Use with caution
vulnerability

Google Dork Query:

site:firebaseio.com ".json"
0
Not verified

What It Does

This dork uses 'site:firebaseio.com' to restrict results to Firebase hosting combined with '.json' to target the REST API endpoints. Firebase databases that lack proper security rules allow public read access to their entire data store through these JSON endpoints, potentially exposing user data, API keys, and application secrets.

Common Use Cases

  • Cloud Database Security Audit: Check if your Firebase databases have misconfigured security rules allowing unauthorized public read access.
  • Data Exposure Assessment: Identify Firebase instances leaking sensitive user data such as emails, passwords, or personal information.
  • Mobile App Security Testing: During authorized app assessments, find the backend Firebase database and verify its access controls.

How to Use Safely

  1. Search Google with this dork to find exposed Firebase database JSON endpoints.
  2. Append '.json' to the Firebase URL root to test if full database read access is enabled.
  3. Review exposed data for sensitive information like user credentials or API keys.
  4. Report misconfigured databases and recommend implementing proper Firebase security rules.

Responsible Use Required

This dork should only be used on systems you own or have explicit authorization to test. Unauthorized access to computer systems is illegal. Always follow ethical guidelines and obtain proper permission before testing.

TAGS

firebase
database
google
mobile

Related Dorks

Google Dork: Phorum Admin" "Database Connection"...

Locates exposed Phorum forum admin panels that may allow unauthorized access to administrative interfaces or sensitive system configurations.

Find "toshiba Pages

Finds exposed Toshiba network camera login pages that may allow unauthorized access to camera feeds.

Find Welcome to Your New Home Page! Pages

Finds welcome to your new home page! pages revealing default installations that have not been properly configured or secured after deployment.