Part 2 of a 3-part series on open-source security tooling. Part 1 covered AppSec tooling in Go. This one is about mobile apps and the cloud backends behind them.

Here's something that catches a lot of mobile developers off guard: your Android APK or iOS IPA is not a locked vault.

Run jadx on an APK, or unzip an IPA, and within a minute you can pull out the client configuration and see exactly which cloud backend the app talks to.

That's why Firebase and Cloud Storage misconfigurations are still a common, high-impact finding in bug bounty programs and mobile penetration tests.

OpenFirebase

🔗 https://github.com/Icex0/OpenFirebase

OpenFirebase (by Icex0) automates this audit.…