Document full static RE of Greenwood School (Boti Education) app 2.4.14

- PROTOCOL.md: base URL, login/session auth, request envelope, push, media
- endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle
- FINDINGS.md: security findings incl. hardcoded dev account in build
- tools: endpoint extractor + credential-safe login script
- results: original analysis report (IDs redacted)

tools/boti_login.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Log in to a Boti Education school API (Green Wood School variant) and cache the session token.
+# Credentials are read from boti.ini in $XDG_CONFIG_HOME (default ~/.config), never hard-coded.
+#
+# boti.ini format:
+#   [boti]
+#   login    = 0600000000
+#   password = whatever
+#
+set -euo pipefail
+
+BASE="https://boti.education/p/greenwood/botiapi/"
+CONF="${XDG_CONFIG_HOME:-$HOME/.config}/boti.ini"
+CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/boti-key"
+
+if [[ ! -f "$CONF" ]]; then
+    echo "missing $CONF (see header of this script for format)" >&2
+    exit 1
+fi
+
+login=$(awk -F= '/^login/{gsub(/[[:space:]]/,"",$2); print $2}' "$CONF")
+password=$(awk -F= '/^password/{gsub(/[[:space:]]/,"",$2); print $2}' "$CONF")
+
+resp=$(curl -sS -m 20 "$BASE/login" \
+    -F "login=$login" \
+    -F "password=$password" \
+    -F "privacy=true" \
+    -F "remembreMe=false")
+
+if ! grep -q '"error":false' <<<"$resp"; then
+    echo "login failed: $(head -c 200 <<<"$resp")" >&2
+    exit 1
+fi
+
+key=$(sed -n 's/.*"keyToken":"\([0-9a-f]*\)".*/\1/p' <<<"$resp")
+if [[ -z "$key" ]]; then
+    echo "no keyToken in response" >&2
+    exit 1
+fi
+
+umask 077
+printf '%s' "$key" > "$CACHE"
+echo "session key cached at $CACHE (40 hex chars)"
+echo "usage: curl \"$BASE/<endpoint>?user_id=<userId>&key=$(cat "$CACHE")\""