# greenwood-school-re

Static reverse engineering of the Greenwood School parent app
(com.botieducation.greenwood), the "horrible mobile app" that is actually a
Capacitor web wrapper by vendor Boti Education (boti.education).

Analyzed: 2.4.14 (versionCode 24140), XAPK from APKPure.
XAPK sha256: f46aa8b126f8f8856ea15e10ed12fa259d02e383f8921b0645139521b7820e69

## Contents

- docs/PROTOCOL.md, full API protocol: base URL, auth, request envelope,
  push registration, media URLs, quirks
- docs/endpoints.md, all 100 app endpoints with get/post and source chunk
- docs/FINDINGS.md, security findings (yes, including the hardcoded dev account)
- tools/extract_endpoints.py, regenerate the endpoint table from decompiled chunks
- tools/boti_login.sh, login + session key caching (credentials from
  ~/.config/boti.ini, never in the repo)
- results/report.md, original analysis notes

## TL;DR

- The app is an Ionic/Angular SPA in a Capacitor 5 shell. All logic in JS.
- Backend: https://boti.education/p/greenwood/botiapi/ (per-school path under
  one shared vendor backend)
- Auth: POST login (phone + plaintext password) -> keyToken (40 hex) used as
  key=<token> on every call. JWT access/refresh headers supported but usually
  empty for parents.
- The build ships a hardcoded dev account in the login page component.
- Verified live with a single login call; no other requests were made against
  the school server.

## No credentials here

The repository contains no credentials or personal data of the account holder.
The one phone/password pair quoted in docs/FINDINGS.md is vendor-shipped demo
content quoted as vulnerability evidence; it is present in every public copy of
the APK. Live credentials belong in ~/.config/boti.ini (chmod 600) on the
machine that runs the tools, never in this repo.