$30 off During Our Annual Pro Sale. View Details »

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

Tomoyuki KOYAMA
August 14, 2018
Technology
1
100

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
Distributed Log Search Based on Time Series Access and Service Relations
tomoyk
0
38
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
tomoyk
0
200
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
tomoyk
2
410
この先生きのこるための学び方 / how-to-learn-tech
tomoyk
1
240
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
tomoyk
0
99
パケットを覗いてみよう / Packet workshop for beginners
tomoyk
0
200
XSSの入力値を調べてみた / searching xss insertion value
tomoyk
3
1.2k
ブレース展開のススメ
tomoyk
0
330
スマートフォンにおける気象データの可視化 / Visualization of the weather data for the smartphone
tomoyk
0
33

Other Decks in Technology

See All in Technology
Module-Federation A game-changer in JavaScript architecture
vitormalencar
0
100
Kaggle Days Championship Final 2022 参加報告
dena_tech
PRO
0
400
バックエンドエンジニアが行うSvelte + Vite なフロントエンド構築
seike460
PRO
1
140
Content editing in Symfony
tgalopin
3
360
Souveraineté numérique et logiciel libre: colloque de la SIF 2022
sfermigier
0
250
Headless CMS in LINE
techverse_2022
PRO
0
160
効率良く開発を進められる閉域 Azure Machine Learning 環境
shuntaito
1
260
デジタル社会の行き着く先にライブラリアンが果たしうる役割を考える / Thinking about the role librarians can play in the destination of the digital society
ykiyota
0
470
今年やったこと_20年以上続くWebサービスのリプレイス_書いたコード_私がモダンかもと思うPerl
masashi_sutou
0
680
AskDoctorsチーム紹介資料 / Introduction of AskDoctors Engineering Team
m3_engineering
1
130
Problems and Solutions for Two Billion Recommendations Per Day
techverse_2022
PRO
0
110
Sports Analyst Meetup #13 (2022/11/26)
keisuke198619
0
140

Featured

See All Featured
Streamline your AJAX requests with AmplifyJS and jQuery
dougneiner
127
8.7k
Art Directing for the Web. Five minutes with CSS Template Areas
malarkey
196
9.7k
Fashionably flexible responsive web design (full day workshop)
malarkey
396
63k
Rails Girls Zürich Keynote
gr2m
87
12k
Six Lessons from altMBA
skipperchong
15
1.6k
What's new in Ruby 2.0
geeforr
335
30k
How to train your dragon (web standard)
notwaldorf
64
4.1k
The Power of CSS Pseudo Elements
geoffreycrofte
51
4.2k
Visualization
eitanlees
126
12k
Debugging Ruby Performance
tmm1
67
11k
JazzCon 2018 Closing Keynote - Leadership for the Reluctant Leader
reverentgeek
175
8.9k
Rebuilding a faster, lazier Slack
samanthasiow
64
7.4k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: mantianxing0111@yahoo.co.jp

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ mantianxing0111@yahoo.co.jp 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: 21449497@qq.com