Firebase

[random-robbie]

Service name

Google Firebase

Can i take it over

No - requires txt record to authenticate it so it's not possible.

[melardev]

funny, I was just trying a few hours ago to take over a firebase app, I could not, but what I noticed is that the TXT record is the same for the same custom domain in the same user session, I did not test further, I was lazy, the remaining test is, to check if the TXT record is the same for the same custom domain after logout/login, and most importantly across any account, because if the victim is given a TXT record, but you are given another one for the same vulnerable.example.com, then it is not vulnerable.

[melardev]

@random-robbie This is the TXT record I get when I try to add github.com:
google-site-verification=_hFoiuxEK5rlpZZfR8DgLq48UvrqRleu6cat5EBe3x0
Can you tell me if you get the same?

[shoeper]

I get a different one: google-site-verification=vENMi3mjve0BU8HfQLJQ3ts8B9U8IF3UDBdWpN8Y1ls

[melardev]

@shoeper Thanks for confirming. I keep getting the TXT I said at the beginning, so I think we get a constant TXT per account and hostname, that would mean it is not vulnerable since other accounts get a different TXT value.

[ankurtehlan]

Can it is possible to takeover firebase subdomain