NEW ANALYSIS
Turn a package into one reverse-engineering and Firebase packet.
Static analysis only. The artifact is never executed, and external checks stay off unless you enable them.
AUTHORIZED ARTIFACTS ONLY
Unified queue
Connecting
AUTOMATED PIPELINE
- 01Identify & containHashes, type, archive-bomb and traversal checks
- 02Android intelligenceManifest, SDKs, components, signing fingerprints
- 03Code & configurationAPKRecon, JADX, endpoints and redacted secrets
- 04Cloud postureFirebase and storage indicators; live reads only when opted in
WORKSPACE
All queued work
Unlock the workspace to load jobs.
AWS S3 + DIGITALOCEAN SPACES
Read-only posture audit
Audits run in the same managed queue as artifact and Firebase analysis. Results appear in Unified queue.
FIREBASE + GOOGLE CLOUD
Service-account blast-radius audit
Authenticate one company-owned service account and enumerate only bounded, read-only metadata. The credential is consumed from memory and is never saved in the job.
SAFETY BOUNDARY
One credential, one queued run
GETUsers, RTDB instance metadata, Firestore databases, Storage metadata, IAM identities
Metadata POSTFirestore listCollectionIds and Cloud Resource Manager testIamPermissions only
BlockedUser changes, database writes, document reads, uploads, downloads, deletes, function calls, proxying
ADMINISTRATION
Workspace management
Create isolated teams, rotate scoped access keys, and disable access without deleting reports.
ACCESS KEY
One-time key delivery
Create a workspace or rotate a key to receive a new scoped key.
ACCESS BOUNDARIES
All workspaces
Administrator access is required.
AUDIT TRAIL
Recent changes
No workspace changes recorded.
OPERATOR PLAYBOOK
From artifact to actionable report
Submit
Upload only an application or archive you own or are authorized to assess. HarborData stores it in a private per-job directory with mode 0600.
Contain
Before extraction, the pipeline blocks absolute paths, parent traversal, oversized entries, excessive entry counts, and expansion bombs.
Map the app
Androguard maps package metadata, permissions, exported Android components, SDK targets and certificate fingerprints. APKRecon extracts high-signal configuration and credential candidates without showing raw values.
Recover source
JADX creates navigable Java/Kotlin-like source and resources. Split packages are unpacked and handled as one job. Native libraries are inventoried separately.
Review cloud signals
Firebase project IDs, service-account identities, S3 buckets, Spaces endpoints, domains and URLs are correlated into the report. Discovered credentials stay fingerprint-only unless the separate authorized posture-audit option is enabled.
Validate carefully
Network checks are opt-in, rate-limited and read-only. Use the Firebase SA screen for a separately supplied credential, or explicitly enable the discovered-SA option for an owned artifact; writes, deletes and object-body downloads remain blocked.
FIREBASE ASSESSMENT
Safe automation and manual review boundaries
Live-safe automation is capped, rate-limited, and read-only. Authenticated checks require a separate credential option, server policy and ownership confirmation. Manual-only or destructive checks are never automated by HarborData: no account creation or deletion, password-reset emails, database writes, uploads, callable function invocation, or exploit payloads.
Live-safe automation
Manual only / destructive
Recon
Correlate project IDs, app IDs, API hosts, buckets, database URLs, functions, hosting, and client configuration found in the artifact or public metadata.
Auth configuration
Review enabled providers, anonymous access, user-enumeration behavior, password policy, MFA, and tenant settings in an authorized console. Account actions and password-reset flows are out of scope.
RTDB
Use bounded unauthenticated GET requests against discovered Realtime Database roots. Rules validation that requires writes, payloads, or credentials is manual only.
Firestore
Perform capped public read and metadata checks only. Collection guessing, document writes, deletes, and rules testing with exploit payloads remain manual only.
Storage
Check discovered bucket and object exposure with bounded metadata or HEAD requests. Object uploads, deletes, overwrites, and body downloads are not automated.
Remote Config
Inspect client defaults and make bounded public read checks where applicable. Publishing, activating, or changing templates is manual and destructive.
Functions / Hosting
Discovered Functions and Hosting endpoints are inventoried only. Function invocation is never automated—not with GET, HEAD, POST, callable requests, fuzzing, or exploit payloads.
authorizedDomains / FDL
Review authorized domains and Firebase Dynamic Links configuration in the owned project console. Redirect or domain-takeover validation requires a separately controlled manual plan.
IAM / service-account identity
Artifact scans fingerprint discovered key material without using it. The separate Firebase SA audit can authenticate a user-supplied owned credential once to enumerate bounded metadata and test permissions without exercising them.
FCM
Review sender IDs, token handling, and server-key hygiene without sending messages or validating credentials. Delivery and authorization tests require a controlled manual procedure.
Checklist reference: Icex0/firebase-pentest-checklist. Use it only within your documented authorization and the safety boundaries above.
Recommended production flow
Run the static packet first. Triage findings. Enable network checks only for the specific owned environment that needs validation. Rotate every confirmed embedded credential, then rebuild and rescan.
Input coverageAPK · XAPK · APKM · APKS · AAB · ZIP · JAR · DEX · SO
OutputsUnified JSON report · source tree · stage logs · provider findings
SafetyNo execution · private storage · redaction · bounded extraction · explicit live checks