佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

49116ff34041caf0476b170ab193ebc5?s=47 Tomoyuki KOYAMA
August 14, 2018
Technology
0
79

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

49116ff34041caf0476b170ab193ebc5?s=128

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
78
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
180
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
2
1k
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
200
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
19

Other Decks in Technology

See All in Technology
3115a782126be714b5f94d24073c957d?s=48 oracle4engineer
2
230
69b4dadef85efe143ac825b62d36ed7c?s=48 fruitriin
2
260
5d715b858124e0dd59af1a92e4397acd?s=48 y_temp4
0
110
24606216ae4bbee28494552cb71cc220?s=48 yosshi_
12
2.6k
80c79a9d024d1e1a253893a78189ce6d?s=48 ujnak
1
110
703c34db2db0e609fddec6a5585ceccc?s=48 kenta_sato3
0
160
Af61fe2beec7f195d7418e0a474a4dfc?s=48 kfujieda
3
1.1k
Cd6e67775ba3275c466e9927ede23080?s=48 nk35jk
1
210
A500dfe11c36aa2912eaf33176fe129f?s=48 oyakata2438
3
360
5919537a0ecfa5d4dea704cf878ae90e?s=48 toshimaru
29
10k
3a9dc8db324dc41de538f0f48e4bd45d?s=48 oguzhan
1
180
84cf8e2803e8ee2f48a2db6493eb749f?s=48 takanariko
5
420

Featured

See All Featured
Aebc2d07a50011e2a30d38435fde564a?s=48 jrom
113
6.8k
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
99
5.7k
761be20b5ebd271008bcee1244fc5b52?s=48 matthewcrist
70
7k
Ba530e786553390f3fb271848485681c?s=48 3n
159
22k
Fe6b81005d1553accd6b2a28f6a2bef1?s=48 phodgson
83
3.7k
D36d2c1821af9249b69ff7f5ed60529b?s=48 tammielis
236
23k
Ecdea9b9714877b86cee08458f085481?s=48 trallard
6
210
B83d5b590577969ee79a5ad845411a7d?s=48 ammeep
652
54k
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
319
53k
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
49
3.2k
A9a491b0fcbe0fbce3d64063a37add99?s=48 rmw
7
540
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
323
14k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: mantianxing0111@yahoo.co.jp

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ mantianxing0111@yahoo.co.jp 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: 21449497@qq.com