Production ERP Analysis
Downloaded the school's Android app from the Play Store, extracted the APK and decompiled it. Turns out the app itself was mostly a thin wrapper around a web application . From the decompiled resources and application structure, I was able to identify the backend URL the app depended on and moved the investigation to the actual web application.
I then started testing the application from the outside, mapping its authentication flow, sessions, routes and role boundaries to see what was actually enforced server-side rather than what the UI made available.
Found role-boundary inconsistencies where parts of functionality associated with another user role responded differently than expected.
Identified server-side session handling weaknesses and endpoints whose protection was not consistently aligned with the application's visible navigation.
Found verbose production error handling exposing framework, application structure and internal implementation details.
The payment workflow exposed transaction-related parameters through the client side, revealing that important payment data was not being treated as completely server-owned state.
The detailed reproduction steps and vulnerable request data are intentionally not shown. They would turn this from a security case study into a practical exploitation guide for a live system.