Omarchy-Big-PC
358027bf27
- PROTOCOL.md: base URL, login/session auth, request envelope, push, media - endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle - FINDINGS.md: security findings incl. hardcoded dev account in build - tools: endpoint extractor + credential-safe login script - results: original analysis report (IDs redacted)
40 lines
1.8 KiB
Markdown
40 lines
1.8 KiB
Markdown
# greenwood-school-re
|
|
|
|
Static reverse engineering of the Greenwood School parent app
|
|
(com.botieducation.greenwood), the "horrible mobile app" that is actually a
|
|
Capacitor web wrapper by vendor Boti Education (boti.education).
|
|
|
|
Analyzed: 2.4.14 (versionCode 24140), XAPK from APKPure.
|
|
XAPK sha256: f46aa8b126f8f8856ea15e10ed12fa259d02e383f8921b0645139521b7820e69
|
|
|
|
## Contents
|
|
|
|
- docs/PROTOCOL.md, full API protocol: base URL, auth, request envelope,
|
|
push registration, media URLs, quirks
|
|
- docs/endpoints.md, all 100 app endpoints with get/post and source chunk
|
|
- docs/FINDINGS.md, security findings (yes, including the hardcoded dev account)
|
|
- tools/extract_endpoints.py, regenerate the endpoint table from decompiled chunks
|
|
- tools/boti_login.sh, login + session key caching (credentials from
|
|
~/.config/boti.ini, never in the repo)
|
|
- results/report.md, original analysis notes
|
|
|
|
## TL;DR
|
|
|
|
- The app is an Ionic/Angular SPA in a Capacitor 5 shell. All logic in JS.
|
|
- Backend: https://boti.education/p/greenwood/botiapi/ (per-school path under
|
|
one shared vendor backend)
|
|
- Auth: POST login (phone + plaintext password) -> keyToken (40 hex) used as
|
|
key=<token> on every call. JWT access/refresh headers supported but usually
|
|
empty for parents.
|
|
- The build ships a hardcoded dev account in the login page component.
|
|
- Verified live with a single login call; no other requests were made against
|
|
the school server.
|
|
|
|
## No credentials here
|
|
|
|
The repository contains no credentials or personal data of the account holder.
|
|
The one phone/password pair quoted in docs/FINDINGS.md is vendor-shipped demo
|
|
content quoted as vulnerability evidence; it is present in every public copy of
|
|
the APK. Live credentials belong in ~/.config/boti.ini (chmod 600) on the
|
|
machine that runs the tools, never in this repo.
|