Document full static RE of Greenwood School (Boti Education) app 2.4.14

- PROTOCOL.md: base URL, login/session auth, request envelope, push, media
- endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle
- FINDINGS.md: security findings incl. hardcoded dev account in build
- tools: endpoint extractor + credential-safe login script
- results: original analysis report (IDs redacted)

docs/FINDINGS.md

@@ -0,0 +1,49 @@
+# Security findings (com.botieducation.greenwood 2.4.14)
+
+Vendor: Boti Education (boti.education). All findings from static analysis of
+the publicly distributed APK; one live login call used to verify the protocol.
+
+## F1. Hardcoded credentials in the shipped production build [HIGH]
+
+extracted/assets/public/1028.js (login page component) contains:
+
+    this.reconnectUser = {id:12745, phone:"0649014703", password:"0649014703"}
+
+This is a leftover dev/demo biometric-reconnect account with phone number as
+password, compiled into the production bundle. Anyone with the APK has a
+username and password. Status of this account on the server unknown; report to
+vendor recommended.
+
+## F2. Plaintext credential transmission [MEDIUM]
+
+POST /login sends the password as a plaintext form field (password=...).
+TLS protects the transport, but the credential sits in plaintext in any
+intermediary logging form data, and the same pattern is reused by
+forgot-password / change-password. No client-side hashing. Common for this
+class of app, still worth flagging.
+
+## F3. Verbose production logging [LOW]
+
+The ApiService logs request payloads, headers and the access token to
+console.log in the release build (visible via adb logcat / remote WebView
+debugging if enabled).
+
+## F4. No certificate pinning, no obfuscation [INFO]
+
+No pinning config in the bundle, no network_security_config restrictions
+beyond defaults, JS bundle fully readable. RE cost: about an hour.
+
+## F5. Broad but plausible permissions [INFO]
+
+CAMERA, fine+coarse LOCATION, microphone (voice recorder plugin), external
+storage, FCM. Location use case is bus tracking (pick endpoints); camera for
+photo upload. No SMS, contacts, or accessibility permission abuse observed.
+
+## Responsible disclosure notes
+
+- Vendor contact is via boti.education; the school itself (Green Wood School,
+  tel 0520744100 per the official welcome message) can escalate.
+- F1 is the only finding with direct account-takeover potential and is
+  trivially verifiable by the vendor.
+- Do not test F1 against the live server beyond confirming it exists in the
+  bundle; that crosses into unauthorized access.