‫Instructor: Hi.
‫Within this lecture,
‫we're going to see how we can run a command
‫in order to get the data from Firestore
‫if the Firestore security rules are not properly configured.
‫So make sure you copy this
‫because you will need the Firebase ID
‫and you will need the collection name.
‫So I'm going to open my notes
‫so you can just open any text file
‫like in order to copy this and make notes for you, okay?
‫And I'm going to paste this over here,
‫so don't mind the key tool and jar signer thing.
‫Just copy your own
‫Firestore key and Firestore collection name.
‫And then over here what we gonna do,
‫we're going to change it to no proxy
‫because we're done with the proxy right now
‫so that it won't intervene with our things.
‫And over here, actually I'm going to go over to settings
‫and find the WiFi,
‫modify WiFi thing one more time
‫and just disable the proxy from here as well
‫so that it can connect to the internet
‫even though if I shut down the charge proxy.
‫So let me open the tweet. Let me try this.
‫Yep, here we go.
‫Yeah, it doesn't seem to be working for some reason.
‫Let me just close this down
‫and just open it one more time to see if it works now.
‫So let me open the Secure Tweet app.
‫Yeah, we still have the files, actually the tweets
‫and let me run this and here we go.
‫Now it's working. So our app is working.
‫Our Firestore information is over here
‫and now I'm going to show you how to hack it.
‫So as you might remember, there are some security rules
‫regarding our database in here.
‫And most of the time,
‫developers start using the database like this,
‫like allowing reading and writing
‫if this requested time
‫is below some date, okay?
‫So there a couple of things to learn over here.
‫You can actually manipulate the security rules
‫in a way that you want.
‫You can even disable reading and writing.
‫Of course, it won't do much for you
‫because nobody will be able to read or write
‫to your database if you do that.
‫But maybe you may want to allow reading,
‫but disable the writing
‫so that everyone can see what's going on in the database,
‫but nobody will be able to change the thing.
‫And you can do something like this as well. Like yeah.
‫I'm gonna allow reading and writing
‫if the request time is less than this date,
‫for example, like one month later or one month before, okay?
‫So maybe you can't even delete this
‫and just say that allow read and write in any condition.
‫So it used to be like this, okay?
‫So most of the time developers use this
‫for test purposes, okay?
‫And they tend to leave it as it is
‫because it will cause them some problems
‫if they don't do it very well,
‫if you, if they don't do it properly
‫Of course, it causes some security issues.
‫So what we wanna do is to try and see
‫if the developers left this Fire security rules,
‫allowing reading and writing for some condition, okay?
‫And the way to do that, we're going to use the REST API
‫or REST calls of the Firestore.
‫So actually Firestore has some REST calls
‫and maybe you don't even know what a REST call is
‫or maybe you don't have any experience
‫with working with any kind of APIs.
‫But it actually allows us or allows developers
‫to send a request to do database
‫and get responses from the database using HTTP requests.
‫So I'm going to show you what I mean.
‫It will be much more easier.
‫So if you search for Firestore REST API, okay?
‫And I suggest you do that with me.
‫It's not only for information,
‫actually you're gonna get some information
‫that you will use right now
‫and find the Firestore REST API documentation.
‫So over here, as you can see it says
‫that this is one of the easiest way to reach the Firestore.
‫Yeah, it's actually the easiest way,
‫but also it's one of the most dangerous way as well.
‫And over here, it instructs us to
‫how to make actually REST calls.
‫And sometimes they change this URL.
‫So for example, rather than V1, it used to be V2
‫or something like BTA V2, okay?
‫So right now it's V1.
‫Maybe when you're watching it will be V2.
‫And over here it asks for your own project ID.
‫And over here, as you can see after default,
‫it gives something like documents, cities, LA,
‫and of course this is an example, okay, not a real thing,
‫and we will replace it with our own collection name.
‫But, you have to make sure that this link is valid.
‫So I suggest you go to that website
‫and just search for the API URL
‫and find the API URL that is current
‫and use it on your own REST calls.
‫So this is made for business.
‫This is made for convenience
‫so that developers can actually use REST calls
‫and try to get data or change data using this commands.
‫But if they don't do it properly, it will enable us
‫or enable hackers to download all the database
‫and change the database in a way that they want.
‫So rather than this project idea,
‫I'm going to copy and paste mine, okay?
‫So make sure you do that as well.
‫So in my case, firestoregoogleapis.com
‫we want project tweet app, okay, my own project ID.
‫And after that, it should be databases and default.
‫Of course, if they changed it,
‫you can just follow along the new procedure, okay?
‫And then make sure you include your collection name.
‫So that is why we have been looking
‫for this collection name.
‫That is why we have been looking for this Firestore ID.
‫And again, if you wonder
‫what would be the optimal choice for Firestore rules,
‫we're gonna go into that in a minute, okay,
‫in the following lectures,
‫how to make Firestore applications safe.
‫So right now I'm just going to close this down
‫because we don't need any emulators
‫or any app in order to get this data.
‫We're going to make this realistic as possible.
‫And I'm going to come over here
‫and rather than saying default documents
‫and cities LA or something, I'm just going to add tweets.
‫And remember we got this from the APK tool.
‫We got this from the network significant stuff.
‫So we definitely know how to do this right now.
‫So we constructed our URL.
‫So this is how we do the REST calls.
‫This is the URL that we're going to use in REST calls.
‫Now in order to do a REST call,
‫we're going to use something called cURL.
‫So like C U R L, okay?
‫And
‫maybe you don't have cURL
‫in your own command line or in your own Windows.
‫Maybe you do have.
‫I suggest that you try and do it with me,
‫but if you don't have it, you can call cURL from anywhere
‫like from online for example.
‫I'm going to show you how.
‫So I'm going to do this in my terminal.
‫And actually cURL Linux has cURL built in.
‫So you can run the same command inside of cURL Linux as well
‫if you fail to find a working cURL service.
‫And I can't even open Google.
‫So let me just run cURL online or run cURL online, okay?
‫And as you can see, there are a couple of options over here
‫like onlinecurl.com, curl builder.com.
‫So there a lot of options that you may try
‫if you don't have cURL on your computer.
‫Most of the times Windows actually has it,
‫but maybe in your case you don't have it.
‫So don't try to,
‫well actually don't bother trying to installing it.
‫Just open cURL Linux or just open any online source
‫and run the same command that I will run in a minute.
‫So I'm going to make this a little bit bigger
‫so that you can see it in a better way, okay?
‫And here you go.
‫Now we know the stuff, we know the constructed URL,
‫so make sure you copy that
‫because we're going to use it, okay?
‫And we're going to run the cURL command like this.
‫And if you want to run a get command, which is getting data,
‫which is for getting data, actually,
‫you can use this command that I'm going to show you.
‫And I'm going to show you other procedures as well.
‫You generally have get for getting data,
‫post for posting or uploading data,
‫and delete for deleting data
‫and update for updating data, okay?
‫So we're gonna use get.
‫So in order to do that just say -X GET
‫with the spaces like this
‫and then you can specify the URL that you have constructed.
‫And you have to specify the URL
‫inside of this quotation mark.
‫So make sure you open the quotation mark
‫and close it and make sure you add the semicolon at the end.
‫That's it, curl -X get and your URL
‫with this quotation marks and semicolon at the end.
‫So this is what we have been looking for.
‫This is a get request.
‫If this works, it will get us all the content inside
‫of our Firestore database and it will display them to us.
‫You won't even believe
‫how many apps have this vulnerability.
‫As you can see, we managed to get all the data
‫within one single command over here, okay?
‫So we now know what is inside of this database.
‫Like we see the name, we see the project,
‫tweet app, databases, documents, tweets
‫and the document IDs later on.
‫And we're going to use this document IDs.
‫They refer to each unique document
‫in the Firestore to its collection.
‫And we can use update or delete cURL requests
‫in order to change the specific values.
‫Like we see the user email. We see the create time.
‫We see the update time and everything over here, okay?
‫Now actually we hacked into the Firestore, right?
‫We got all the data and it doesn't even end here.
‫We can delete them. We can change them if we want.
‫So let me try this, okay?
‫In order to delete any document,
‫all you have to do is just run the same command, okay?
‫But not exactly the same.
‫Rather than get, I'm gonna run delete.
‫And of course I'm not going to try and delete
‫all the collection over here, okay?
‫But rather, I will add a slash
‫and add the document ID that I want to delete.
‫So I'm going to add the slash at the end of the tweets
‫and I'm going to choose any document ID from here
‫and paste it over here.
‫Like that.
‫And let me try one more time. Yeah, here you go. Like this.
‫So this document start with Nxb6.
‫Let me find that document from our Firestore
‫so that we can actually track if it's been deleted or not.
‫So let me see. Where is our Firestore? Yeah, here you go.
‫Let me go to data and let me find that document over here.
‫Like as you can see, this is Nxb68. Yeah, here you go.
‫So I'm going to hit enter and I'm going to go back and see
‫if we managed to delete or not.
‫Actually, we can make it like this
‫and just see it in real time.
‫Here you go. It's now deleted.
‫As you can see, we managed to gather the data,
‫we managed to get the data,
‫and we even managed to delete the data.
‫So it's very dangerous if you leave stuff like this.
‫So now you can try this with other document names like that.
‫So let me try this, okay?
‫Let me delete the existing one over here
‫and let me paste the new one.
‫For some reason, it doesn't work.
‫Let me just do it from here.
‫And there are some gibberish characters.
‫So let me just do it from scratch.
‫I'm going to delete this, okay?
‫And I'm going to hit slash
‫and then I'm going to try and paste this one more time.
‫Here you go. Now let's find this.
‫And here you go. Now it's deleted.
‫So we're pretty certain that we can delete the data.
‫We can actually manipulate the database
‫in a way that we want.
‫So this is very good.
‫So you have learned a lot in the section, right?
‫You have learned what is Firebase.
‫You have learned how to create a Firestore project.
‫You have learned how to find Firestore A A IDs
‫and some other information using APK tool.
‫And even you have learned network sniffing, right?
‫But what we gonna do is to learn how to make our app secure,
‫changing the security rules over here
‫in our Firestore database because that is one of the reasons
‫that I have created this course
‫in order to learn how hackers hack the things that they do
‫and in order to learn how to protect ourselves
‫against these attacks as well.
‫So rather than allowing everyone
‫to run this kind of cURL commands,
‫we're going to limit it
‫and we're going to see how to do this in various ways.
‫Let's do that within the next lecture.