[halohalomr1213]

印度社交应用

——FireMass发布第二波SHA1哈希值，用户数达2万，哈希值为19983。

---

关于印度社交网络应用 Firebase Firestore 数据泄露事件

：完整用户数据库遭到泄露，包括姓名、电话号码、出生日期、设备 ID、FCM 推送令牌等所有信息。任何会输入 URL 的人都可以读取所有字段。

日期： 2026 年 8 月；
格式： JSON；
用户数： 20,000；
密码数： 19,983；SHA1 哈希值（未加盐 - hashcat 模式 100）；
电话号码： 19,983（+91 印度）。

---

公开字段：

姓名、电话（+91）、电子邮件、出生日期、密码（SHA1）、设备 ID、设备名称、fcmToken、推荐码、邀请码、个人简介、头像、性别、创建时间、最后在线时间

---

样本数据

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat 信息：

SHA1 哈希值未加盐——已准备好用于 hashcat 模式 100：

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

包含内容：

· 19,983 个真实的印度电话号码（+91 前缀）——可用于短信/SIM 卡交换操作
· 19,983 个SHA1 哈希值——未加盐，Hashcat 模式 100
· FCM 推送令牌——可用于推送通知劫持
·设备 ID——用于设备指纹识别
·出生日期、姓名、个人简介——用于社交工程或身份盗窃的完整个人资料

---

这

是FireMass 流水线发布的第 2 批（共约 25 批）。扫描器在互联网上发现了40 多个开放的 Firebase 项目。随着我整理这些转储文件，后续还会发布更多。

---

最后总结：

我们不出售数据。我们只是进行工具测试，分享结果。这就是开发者想当然地认为 Firebase 默认安全时会发生的情况。

---

下载

[arpit51]

kk kkk

[seopirates]

Thanks

[BonusBonus]

thanks for sharing

[Gluttonbelly]

Great share!

[blacknight]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

[thedeadgod]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

[linuxer]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

[rohitk1007]

zes ddfd dfdfd dfdfd

[trexy]

thanks