Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishi...

Avatar for Tomoyuki KOYAMA Tomoyuki KOYAMA
August 14, 2018
Technology
1
180

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Avatar for Tomoyuki KOYAMA

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
Reading HTTP Client Hints
Avatar for Tomoyuki KOYAMA tomoyk
0
99
Log message with JSON item count for root cause analysis in microservices
Avatar for Tomoyuki KOYAMA tomoyk
1
220
Distributed Log Search Based on Time Series Access and Service Relations
Avatar for Tomoyuki KOYAMA tomoyk
0
340
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
Avatar for Tomoyuki KOYAMA tomoyk
0
430
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
Avatar for Tomoyuki KOYAMA tomoyk
1
960
この先生きのこるための学び方 / how-to-learn-tech
Avatar for Tomoyuki KOYAMA tomoyk
1
400
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
Avatar for Tomoyuki KOYAMA tomoyk
0
190
パケットを覗いてみよう / Packet workshop for beginners
Avatar for Tomoyuki KOYAMA tomoyk
0
350
XSSの入力値を調べてみた / searching xss insertion value
Avatar for Tomoyuki KOYAMA tomoyk
3
1.5k

Other Decks in Technology

See All in Technology
リアーキテクティングのその先へ 〜品質と開発生産性の壁を越えるプラットフォーム戦略〜 / architecture-con2025
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
0
6.2k
【M3】攻めのセキュリティの実践！プロアクティブなセキュリティ対策の実践事例
Avatar for mizu axelmizu
0
180
Building AI Applications with Java, LLMs, and Spring AI
Avatar for Thomas Vitale thomasvitale
1
230
Greenは本当にGreenか？ - B/GデプロイとAPI自動テストで安心デプロイ
Avatar for Kaz Watanabe kaz29
0
130
持続可能なアクセシビリティ開発
Avatar for azukiazusa azukiazusa1
6
310
米軍Platform One / Black Pearlに学ぶ 極限環境DevSecOps
Avatar for jyoshise jyoshise
2
530
なぜブラウザで帳票を生成したいのか　どのようにブラウザで帳票を生成するのか
Avatar for yagisan-reports yagisanreports
1
190
マルチドライブアーキテクチャ: 複数の駆動力でプロダクトを前進させる
Avatar for Kenichi SUZUKI knih
0
9.3k
AI エージェント活用のベストプラクティスと今後の課題
Avatar for Asei Sugiyama asei
1
220
レガシーシステム刷新における TypeSpec スキーマ駆動開発のすゝめ
Avatar for karacoro / からころ tsukuha
2
610
巨大モノリスのリプレイス──機能整理とハイブリッドアーキテクチャで挑んだ再構築戦略
Avatar for ZOZO Developers zozotech
PRO
0
270
AI × クラウドで シイタケの収穫時期を判定してみた
Avatar for Lamaglama39 lamaglama39
1
390

Featured

See All Featured
The Language of Interfaces
Avatar for Des Traynor destraynor
162
25k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
9
1k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
15k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
31
3k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
36
7k
Navigating Team Friction
Avatar for Lara Hogan lara
190
16k
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
379
70k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
527
40k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
432
66k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
55
9.3k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
231
22k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: [email protected]

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ [email protected] 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: [email protected]