HIGH SEVERITYHOSTINGCVSS 8.6Requires Account VerificationID: firebase
Firebase Hosting Dangling DNS & Takeover Fingerprint
A custom domain points to Firebase Hosting edge without an active project binding. Attackers can claim unallocated project IDs.
DNS CNAME Delegation Rules
*.web.app / *.firebaseapp.com
CNAME points to *.web.app. Returns 404 with 'Site Not Found'.
404 Not Found
Authoritative Response Token
“Site Not Found”
curl -sI http://subdomain.example.com | grep 'Site Not Found'When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.
Remediation Guide & Defensive Action Plan
Immediate Action Required: Delete the CNAME pointing to Firebase or link your custom domain in the Firebase Console.
Defensive Verification Checklist:
- Audit authoritative DNS zone records for any CNAME pointing to
*.web.app / *.firebaseapp.com. - Verify whether the target resource or bucket still exists under your organization's cloud tenant.
- If decommissioned, delete the DNS record immediately to close the public exposure window.
- Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.
Terraform Remediation Example
# Remove Firebase Hosting CNAME
ATTACK SURFACE DETECTION COMPARISON
Why Static DNS Scanners Miss Firebase Hosting Takeovers
Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.
Firebase Hosting Takeover FAQs
Google requires adding TXT verification records before provisioning SSL certificates on Firebase Hosting.
FREE UNRESTRICTED SCANNER
Scan Your Domain for Firebase Hosting Orphans
Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.