firebase apk scanner

Name: firebase apk scanner
Author: trailofbits

by trailofbits·2mo ago

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication is…

Security & ComplianceClaude CodeMedium risk · 中风险open source · 开源

Before you install安装前须知

!Runs shell commands会执行命令

!Accesses the network会访问网络

Editor's verdict· 编辑结论

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoin…
— Editorial team · 编辑团队

Install via Skills CLI

Use npx skills add to install this skill into the selected agent. Phase 0 commands are generated from source rules, not verified.

Codex

npx skills add https://github.com/trailofbits/skills/blob/main/plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md -g -a codex -y

Drop `-g` to install project-locally

✓

Best for适合什么场景

Decompile the APK using apktool
Test authentication endpoints (open signup, anonymous auth, email enumeration)
Test Realtime Database (unauthenticated read/write, auth bypass)

✗

Not for不适合什么场景

Workflows that require stronger human review than this catalog entry documents.需要比当前目录条目更严格人工复核的工作流。

vs alternativesvs 其他选择

Full compare table完整对比表 →

#1api-security-testing

API安全测试的专业技能和方法论

3.7k stars

diff · 差异Best for the OWASP-API-Top-10 workflow — auth bypass, broken object-level authorization, mass assignment, injection paths through API surfaces. Methodology-driven, not just a scanner. Strongest before a major API release or annual security review. Skip it for infrastructure security (TLS, secret rotation); that's a different toolchain.

#2aig-scanner

A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via

3.6k stars

diff · 差异Best for the AI-specific failure modes — prompt-injection vectors, over-broad tool permissions, agent-escape paths, skill supply-chain risk. Catches issues classical app-sec scanners miss because they don't know what an agent or a skill is. Strongest in agent / skill ecosystem audits. Skip it for traditional web-app pentest; api-security-testing is more efficient there.

#3wooyun-legacy

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati

1.6k stars

diff · 差异Best for grounding security review in real-world breach patterns — 22,000+ historical Chinese-internet security cases covering business-logic vulnerabilities, IDOR, race conditions, design-level data leaks. A reference corpus, not a scanner. Strongest as input to a threat-model exercise. Skip it as a standalone scanner; pair with api-security-testing for the actual review.

Side-by-side compare维度对比

Key differences with same-lane alternatives

	this skill · 当前firebase apk scanner	api-security-testing	aig-scanner	wooyun-legacy
Rating · 评分	—	—	—	—
Stars · 星标	5.1k	3.7k	3.6k	1.6k
Risk · 风险	Medium risk · 中风险	Medium risk · 中风险	Medium risk · 中风险	Low risk · 低风险
Best for · 最适合	Decompile the APK using apktool	API安全测试的专业技能和方法论	A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via	WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati
Not for · 不适合	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.

Audit notes审计备注

not individually audited · 未独立审计

Source源码open on GitHub · 公开✓

Author作者community · 社区!

Network网络访问not individually audited · 未独立审计!

Filesystem文件写入not individually audited · 未独立审计!

Dependencies依赖not individually audited · 未独立审计!

Telemetry遥测none · 无✓