Scan Types

FireScan provides traditional and advanced scan types.

Traditional scans

Basic enumeration using wordlists. Safe for production (probe mode).

--rtdb

Enumerates Realtime Database paths.

firescan > scan --rtdb -l users

Tests paths like /users, /user, /Users, /USER against security rules.

--firestore

Enumerates Firestore collections.

firescan > scan --firestore -l all

--storage

Checks if Cloud Storage buckets are listable.

firescan > scan --storage

--functions

Tests Cloud Functions across 7 regions.

firescan > scan --functions

Regions tested:

• us-central1, us-east1, us-east4
• europe-west1, europe-west2
• asia-east2, asia-northeast1

--hosting

Checks for publicly exposed firebase.json.

firescan > scan --hosting

--all

Runs all traditional scans.

firescan > scan --all

Advanced scans

Requires --test or --audit mode.

--unauth

Tests access without authentication.

firescan > scan --unauth

Runs in probe mode (read-only).

--write

Tests write permissions (create/update/delete).

firescan > scan --write --test

--rules

Validates security rules with test cases.

firescan > scan --rules --rtdb --firestore --test

--authattack

Tests authentication security.

firescan > scan --authattack --audit

Tests:

• JWT algorithm confusion
• Custom claims injection
• Token expiration bypass
• Signature validation

--storage-sec

Deep storage security testing.

firescan > scan --storage-sec --test

Tests:

• CORS misconfiguration
• Bucket ACLs
• Directory traversal
• Malicious uploads (audit mode)

Options

Wordlists

scan --rtdb -l users     # User-related paths
scan --rtdb -l config    # Configuration paths
scan --rtdb -l all       # All wordlists (200+ terms)

Built-in wordlists: users, config, passwords, functions, database, storage, security, all

Concurrency

scan --all -c 100        # 100 workers (fast)
scan --all -c 10         # 10 workers (stealthy)

Default: 50 workers

Rate limiting

scan --all --rate-limit 10    # 10 requests/second
scan --all --rate-limit 0     # Unlimited

JSON output

scan --all --json
scan --all --json > results.json

Quick reference

Scan	Safety Mode	Use Case
--all	Probe	Standard enumeration
--unauth	Probe	Test without auth
--rtdb -l users	Probe	Target specific paths
--write --test	Test	Test write permissions
--authattack --audit	Audit	Deep auth testing

Next

• Safety Modes - Understand probe/test/audit
• API Reference: scan - Full command details