[hacker00x01]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

---

asdfgh

[prpc7]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

---

asdfgh

[duol123]

Nice .

[random_user123]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

---

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

---

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

---

Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }

---

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

---

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

---

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

---

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

---

DOWNLOAD

thanks brother....

[z1ne99]

interested

[karansinghfm]

thanks for this

[Luci786]

Thanks

[Octavi2398]

thanks

[ylc787944664]

thanks

[kkman]

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.