DBHunter
Infinity Member
Golden Member
- Joined
- August 23, 2025
- Messages
- 2,612
- Reaction score
- 7,325
- Points
- 113
- Thread Author
- #1
HELLO DNA
About the leak
American Auto Shipping — a US-based vehicle transport company handling hundreds of vehicle shipping orders — left their Firebase CRM wide open. Database aas-crm-default-rtdb.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND modify data. Write escalation confirmed on 3/3 test operations — admin user created, organization injected, audit node written, all HTTP 200.
Inside: 59,278 unique customer email addresses, 39,454 phone numbers, 222 FULL CREDIT CARD NUMBERS (Visa 160, Mastercard 63, Amex 39) — catastrophic PCI DSS violation. 294 custom quotes with complete PII: first name, last name, email, phone, additional information. 9,799 internal nginx API endpoints (http://nginx/api/calculations/*/book) — full internal architecture exposed including the ship.cars TMS integration.
Two organizations in the database: American Auto Shipping + Cruise Control Auto Transport. The credit cards are not test numbers — they pass Luhn validation, have valid BINs. These are real customer credit cards entered manually by agents into an unprotected staging database.
The write access is catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake orders. Alter payment amounts. Create admin users. Write fraudulent customer communications. The database is a blank canvas for any attacker with the URL.
Date: 05.08.2026
Format: Full Firebase RTDB JSON export (77MB raw) + write escalation proof (3/3 HTTP 200) + PII extraction
Users: 59,278 (with emails, 294 with full PII from custom quotes)
Phone Numbers: 39,454 (US format — 10 digits)
Credit Cards: 222 (Visa 160, Mastercard 63, Amex 39) — full numbers, plaintext
Shipping Orders: 378 (3 live + 375 backup) with full customer PII and addresses
Organizations: 2 (American Auto Shipping, Cruise Control Auto Transport)
Lead Providers: 2 (provider contracts with pricing data)
GraphQL Queries: 20 (IntrospectionQuery v1-v4)
Nginx Internal URLs: 9,799 (calculations, orders, payments — full internal API map)
Compromised Data Includes
customerFirstName · customerLastName · customerEmail · customerPhone · customerStreetAddress1 · customerStreetAddress2 · customerCity · customerState · customerZip · customerReferredBy · balancePaidBy · billToCustomer · carrierPay · deliveryCity · deliveryState · deliveryZip · dateCreated · creditCardNumber · organizationName · email · phone · additionalInformation · leadProvider · leadPackage · leadPrice · nginxAPIEndpoint · shipCarsTMSURL · graphQLQuery
Affected Entities
American Auto Shipping — US vehicle transport company, full CRM exposed
Cruise Control Auto Transport — second organization within the database
ship.cars TMS — integration with transport management system
59,278 individual customers — emails, phones, full shipping addresses
222 customers with FULL credit card numbers — Visa, Mastercard, Amex, all in plaintext
Infrastructure Map
Code:
Live Access Status (August 5, 2026)
Code:
Sample Data — Credit Cards (full numbers, plaintext)
Code:
Sample Data — Customer Quotes
Code:
Sample Data — Shipping Orders
Code:
Internal nginx API Endpoints (9,799 total)
Code:
Email Samples (59,278 unique)
Code:
Write Escalation — Full Database Control Confirmed (3/3 HTTP 200)
Code:
3/3 HTTP 200 — full write access confirmed
What's in the dump
Code:
Final word
This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam, or the "staging" flag made someone think "it's just staging, no real data in there."
Except there IS real data. 222 full credit card numbers. 59,278 customer emails. 378 shipping orders with full addresses. Internal nginx API with thousands of endpoints. A production system for an American vehicle transport company integrated with ship.cars TMS.
The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake orders. Alter payment amounts. Create admin users. Write fraudulent customer communications. The database is a blank canvas for any attacker who finds the URL.
These 222 card numbers are live, production Visa, Mastercard, and Amex cards. Stored in plaintext in Firebase. PCI DSS violation level: catastrophic.
American Auto Shipping is 5/25 from the FireMass v5 pipeline — 33 exposed databases, 19 fully writeable, 63K emails, 393 credit cards total. More drops from the pipeline soon. Same exploit. Different companies.
DOWNLOAD
About the leak
American Auto Shipping — a US-based vehicle transport company handling hundreds of vehicle shipping orders — left their Firebase CRM wide open. Database aas-crm-default-rtdb.firebaseio.com — no auth, no token, no referer check. Full read AND write. Anyone who knows the URL can dump the entire database AND modify data. Write escalation confirmed on 3/3 test operations — admin user created, organization injected, audit node written, all HTTP 200.
Inside: 59,278 unique customer email addresses, 39,454 phone numbers, 222 FULL CREDIT CARD NUMBERS (Visa 160, Mastercard 63, Amex 39) — catastrophic PCI DSS violation. 294 custom quotes with complete PII: first name, last name, email, phone, additional information. 9,799 internal nginx API endpoints (http://nginx/api/calculations/*/book) — full internal architecture exposed including the ship.cars TMS integration.
Two organizations in the database: American Auto Shipping + Cruise Control Auto Transport. The credit cards are not test numbers — they pass Luhn validation, have valid BINs. These are real customer credit cards entered manually by agents into an unprotected staging database.
The write access is catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake orders. Alter payment amounts. Create admin users. Write fraudulent customer communications. The database is a blank canvas for any attacker with the URL.
Date: 05.08.2026
Format: Full Firebase RTDB JSON export (77MB raw) + write escalation proof (3/3 HTTP 200) + PII extraction
Users: 59,278 (with emails, 294 with full PII from custom quotes)
Phone Numbers: 39,454 (US format — 10 digits)
Credit Cards: 222 (Visa 160, Mastercard 63, Amex 39) — full numbers, plaintext
Shipping Orders: 378 (3 live + 375 backup) with full customer PII and addresses
Organizations: 2 (American Auto Shipping, Cruise Control Auto Transport)
Lead Providers: 2 (provider contracts with pricing data)
GraphQL Queries: 20 (IntrospectionQuery v1-v4)
Nginx Internal URLs: 9,799 (calculations, orders, payments — full internal API map)
Compromised Data Includes
customerFirstName · customerLastName · customerEmail · customerPhone · customerStreetAddress1 · customerStreetAddress2 · customerCity · customerState · customerZip · customerReferredBy · balancePaidBy · billToCustomer · carrierPay · deliveryCity · deliveryState · deliveryZip · dateCreated · creditCardNumber · organizationName · email · phone · additionalInformation · leadProvider · leadPackage · leadPrice · nginxAPIEndpoint · shipCarsTMSURL · graphQLQuery
Affected Entities
American Auto Shipping — US vehicle transport company, full CRM exposed
Cruise Control Auto Transport — second organization within the database
ship.cars TMS — integration with transport management system
59,278 individual customers — emails, phones, full shipping addresses
222 customers with FULL credit card numbers — Visa, Mastercard, Amex, all in plaintext
Infrastructure Map
Code:
firebase rtdb aas-crm-default-rtdb.firebaseio.com — PUBLIC, read + write, no auth firebase storage aas-crm-default-rtdb.appspot.com — HTTP 404 (not configured) firebase firestore aas-crm-default-rtdb — HTTP 404 (not configured) nginx internal API http://nginx/api/* — 9,799 internal endpoints (calculations, orders, payments) ship.cars TMS https://americanautoshipping-tms.ship.cars/checkout/calculation/* — TMS integration GraphQL backend — active introspection queries (v1-v4)Live Access Status (August 5, 2026)
Code:
firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json) firebase rtdb write — LIVE (HTTP 200 on 3/3 test endpoints — admin injected, org created, audit node) firebase storage — HTTP 404 (not configured) firebase firestore — HTTP 404 (not configured) nginx internal API — UNTESTED (9,799 endpoints available for exploration)Sample Data — Credit Cards (full numbers, plaintext)
Code:
4941390036594900 (Visa) 5524333357417170 (Mastercard) 5595910035673722 (Mastercard) 4094510002022462 (Visa) 4100390612241311 (Visa) 4342573009649398 (Visa) 4388576144408310 (Visa) 5122309549268149 (Mastercard) 4266841757378748 (Visa) 5424181354586591 (Mastercard)Sample Data — Customer Quotes
Code:
Michael Bates | Thebatesgrp@gmail.com | +16177026347 Emilio Hernandez | Emilio.Hernandez.af@gmail.com | +17179690343 Alexis Santana | asmdsymone@gmail.com | +19293429686 Javier Rodriguez | jrod246991@yahoo.com | +19728241868 William Thompson | williamthompson425@gmail.com | +17047469102Sample Data — Shipping Orders
Code:
Order #1: customerFirstName: "Keith" customerLastName: "Crosby" customerEmail: "KDAWNCROSBY@AOL.COM" customerPhone: "3166164245" customerStreetAddress1: [REDACTED] customerCity: [REDACTED] customerState: "KS" customerZip: [REDACTED] balancePaidBy: "Carrier" carrierPay: $800 Order #2: customerFirstName: "Paris" customerLastName: "Palmer" customerEmail: "parispal66@gmail.com" customerPhone: "6304707426" customerStreetAddress1: [REDACTED] customerCity: [REDACTED] customerState: "IL" balancePaidBy: "Customer"Internal nginx API Endpoints (9,799 total)
Code:
http://nginx/api/calculations/985e9019dce19d10/book http://nginx/api/calculations/1af8dcde19c827e7/book http://nginx/api/calculations/a7470ae26386fcb1/book http://nginx/api/orders/1837E63C7261A137/payment http://nginx/api/calculations/8f35d8ee31fe5f3fEmail Samples (59,278 unique)
Code:
michaeldaviesjr01@gmail.com salvarado@fortrend.com jclefkow@gmail.com ticorace45@gmail.com luistepox244@gmail.com saithati2point0@gmail.com e.steven.hernandez89@gmail.com exaflt@hotmail.com ds.visionaryrei@gmail.com MSensei415@Gmail.com scott@brickcapitalre.com t.brown91@hotmail.com angxu04@yahoo.com diego@ionicc.com han831101@gmail.comWrite Escalation — Full Database Control Confirmed (3/3 HTTP 200)
Code:
PUT /security_audit/.json → HTTP 200 — audit node injected PUT /admin_users/AUDIT_POC.json → HTTP 200 — super_admin user created with credentials PUT /organizations/AUDIT_ORG.json → HTTP 200 — audit organization injected3/3 HTTP 200 — full write access confirmed
What's in the dump
Code:
· aas-crm-default-rtdb_full.json — complete 77MB Firebase RTDB export (28 top-level keys) · aas-crm_credit_cards.csv — 222 credit cards with BIN analysis (Visa 160, MC 63, Amex 39) · aas-crm_emails.txt — 59,278 unique customer email addresses · aas-crm_phones.txt — 39,454 phone numbers · aas-crm_quotes.json — 294 custom quotes with full PII (firstName, lastName, email, phone) · aas-crm_orders.json — 378 shipping orders with complete customer PII and addresses · aas-crm_nginx_urls.txt — 9,799 internal API endpoints · aas-crm_graphql_queries.json — 20 GraphQL introspection queries (v1-v4) · aas-crm_organizations.json — American Auto Shipping + Cruise Control Auto Transport · aas-crm_lead_providers.json — provider contracts with pricing · aas-crm_write_escalation.json — 3/3 HTTP 200 proof (admin injected, org created) · aas-crm_infrastructure_map.md — full architecture mapping · FIREMASS_V5_OFFER_AAS-CRM.md — this document Total: 77MB raw / ~8MB compressedFinal word
This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to true — the equivalent of leaving your database password in a README.md committed to a public repo. Google sends automated "your database is insecure" warnings to the Firebase project owner. For years. The emails went to spam, or the "staging" flag made someone think "it's just staging, no real data in there."
Except there IS real data. 222 full credit card numbers. 59,278 customer emails. 378 shipping orders with full addresses. Internal nginx API with thousands of endpoints. A production system for an American vehicle transport company integrated with ship.cars TMS.
The write access is what makes this catastrophic. It's not just a data leak — it's an active database anyone can modify. Inject fake orders. Alter payment amounts. Create admin users. Write fraudulent customer communications. The database is a blank canvas for any attacker who finds the URL.
These 222 card numbers are live, production Visa, Mastercard, and Amex cards. Stored in plaintext in Firebase. PCI DSS violation level: catastrophic.
American Auto Shipping is 5/25 from the FireMass v5 pipeline — 33 exposed databases, 19 fully writeable, 63K emails, 393 credit cards total. More drops from the pipeline soon. Same exploit. Different companies.
DOWNLOAD
