firebase.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Gathering subdomains using DNSDumpster...\n"
     ]
    }
   ],
   "source": [
    "from dnsdumpster.DNSDumpsterAPI import DNSDumpsterAPI\n",
    "\n",
    "print('Gathering subdomains using DNSDumpster...')\n",
    "results = DNSDumpsterAPI().search('firebaseio.com')\n",
    "domains = [domain['domain'] for domain in results['dns_records']['host']]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Gathering subdomains through the downloaded file...\n"
     ]
    }
   ],
   "source": [
    "from bs4 import BeautifulSoup\n",
    "\n",
    "print('Gathering subdomains through the downloaded file...')\n",
    "with open('subdomains.html', 'r') as f:\n",
    "    s = BeautifulSoup(f.read(), 'html.parser')\n",
    "    \n",
    "table = s.find('div', class_='col-xs-12').find('table')\n",
    "domains.extend([row.find('a')['href'] for row in table.find('tbody').find_all('tr')[:-1]])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import requests\n",
    "\n",
    "def clean(domain):\n",
    "    if domain.count('http://') == 0:\n",
    "        url = ('https://{}/.json').format(domain)\n",
    "    else:\n",
    "        domain = domain.replace('http', 'https')\n",
    "        url = ('{}.json').format(domain)\n",
    "    return url\n",
    "\n",
    "def work(url):\n",
    "    r = requests.get(url).json()\n",
    "    if 'error' in r.keys():\n",
    "        if r['error'] == 'Permission denied':\n",
    "            return {'status':-1, 'url':url}\n",
    "        else:\n",
    "            return {'status':0, 'url':url, 'data':r}\n",
    "    else:\n",
    "        return {'status':1, 'url':url, 'data':r}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Cleaning and looting!\n"
     ]
    }
   ],
   "source": [
    "print('Cleaning and looting!')\n",
    "urls = map(clean, domains)\n",
    "loot = list(map(work, urls))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Saving results to results.json\n"
     ]
    }
   ],
   "source": [
    "import json\n",
    "\n",
    "print('Saving results to results.json')\n",
    "with open('results.json', 'w') as f:\n",
    "    json.dump(loot, f)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Secure databases found:              10\n",
      "Possible vulnerable databases found: 10\n",
      "Vulnerable databases found:          10\n"
     ]
    }
   ],
   "source": [
    "l = {'1':0, '0':0, '-1':0}\n",
    "\n",
    "for result in loot:\n",
    "    l[str(result['status'])] +=1\n",
    "\n",
    "print('Secure databases found:              {}'.format(l['-1']))\n",
    "print('Possible vulnerable databases found: {}'.format(l['0']))\n",
    "print('Vulnerable databases found:          {}'.format(l['1']))"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.5.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}