Omarchy-Big-PC
358027bf27
- PROTOCOL.md: base URL, login/session auth, request envelope, push, media - endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle - FINDINGS.md: security findings incl. hardcoded dev account in build - tools: endpoint extractor + credential-safe login script - results: original analysis report (IDs redacted)
greenwood-school-re
Static reverse engineering of the Greenwood School parent app (com.botieducation.greenwood), the "horrible mobile app" that is actually a Capacitor web wrapper by vendor Boti Education (boti.education).
Analyzed: 2.4.14 (versionCode 24140), XAPK from APKPure. XAPK sha256: f46aa8b126f8f8856ea15e10ed12fa259d02e383f8921b0645139521b7820e69
Contents
- docs/PROTOCOL.md, full API protocol: base URL, auth, request envelope, push registration, media URLs, quirks
- docs/endpoints.md, all 100 app endpoints with get/post and source chunk
- docs/FINDINGS.md, security findings (yes, including the hardcoded dev account)
- tools/extract_endpoints.py, regenerate the endpoint table from decompiled chunks
- tools/boti_login.sh, login + session key caching (credentials from ~/.config/boti.ini, never in the repo)
- results/report.md, original analysis notes
TL;DR
- The app is an Ionic/Angular SPA in a Capacitor 5 shell. All logic in JS.
- Backend: https://boti.education/p/greenwood/botiapi/ (per-school path under one shared vendor backend)
- Auth: POST login (phone + plaintext password) -> keyToken (40 hex) used as key= on every call. JWT access/refresh headers supported but usually empty for parents.
- The build ships a hardcoded dev account in the login page component.
- Verified live with a single login call; no other requests were made against the school server.
No credentials here
The repository contains no credentials or personal data of the account holder. The one phone/password pair quoted in docs/FINDINGS.md is vendor-shipped demo content quoted as vulnerability evidence; it is present in every public copy of the APK. Live credentials belong in ~/.config/boti.ini (chmod 600) on the machine that runs the tools, never in this repo.