FireScan

Appearance

Examples ​

Common FireScan workflows.

Quick vulnerability check ​

bash
firescan
firescan > set projectID target-app
firescan > set apiKey AIza...
firescan > auth --create-account
firescan > scan --all

Test unauthenticated access ​

bash
firescan > scan --unauth

Finds data accessible without authentication.

Enumerate specific service ​

bash
# RTDB only
firescan > scan --rtdb -l users

# Firestore only
firescan > scan --firestore -l config

# Cloud Functions
firescan > scan --functions

Extract discovered data ​

bash
# After finding readable path
firescan > extract --rtdb --path users
firescan > extract --firestore --path Users --output data.json

Test write permissions ​

bash
firescan > scan --write --test

Creates test data in isolated paths.

Stealthy scanning ​

bash
firescan > scan --all -c 10 --rate-limit 5

Low concurrency + rate limiting = less detectable.

Fast scanning ​

bash
firescan > scan --all -c 100

High concurrency for speed.

JSON output ​

bash
firescan > scan --all --json > results.json

For automation or tool integration.

Save and resume session ​

bash
# Save
firescan > save-quit

# Resume later
./firescan --resume

Config file workflow ​

bash
# Generate config
firescan > make-config > myapp.yaml

# Edit myapp.yaml with your values

# Launch with config
./firescan --config myapp.yaml

See also ​

Support FireScan

Enjoying these workflows? Support the project by buying me a coffee or learn about custom security testing services for your Firebase app.