Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

49116ff34041caf0476b170ab193ebc5?s=47 Tomoyuki KOYAMA
August 14, 2018
Technology
0
85

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

49116ff34041caf0476b170ab193ebc5?s=128

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
120
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
2
220
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
1
160
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
89
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
190
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
3
1.1k
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
250
49116ff34041caf0476b170ab193ebc5?s=48 tomoyk
0
26

Other Decks in Technology

See All in Technology
96c31fe94f5e9b0eef4a606eaadcbc04?s=48 yoshiiryo1
0
510
Db970064044641bf2b495822d66f0685?s=48 higebu
1
230
A857277d74d4719f7f7751dca5ed553e?s=48 cmusudakeisuke
0
13k
0deae06ab5d86b39feeec2e23a30b88a?s=48 yoku0825
PRO
8
3.8k
6d161fe47f36ac295189c3b6a0db2a9a?s=48 masahirokawahara
0
220
3318abf64ba11ee70d4f5dee62051801?s=48 tagucch
0
110
23f4d5d797a91b6d17d627b90b5a42d9?s=48 kentaro
0
130
8fea11f3454c94cb5a5599ff03021471?s=48 kwappa
1
580
49f49940f0831a426745c028684bcdad?s=48 hatena
1
2.5k
4cafe6a1c6287d64d7252279eeeffa94?s=48 moongift
0
120
49f49940f0831a426745c028684bcdad?s=48 hatena
0
2.7k
49f49940f0831a426745c028684bcdad?s=48 hatena
1
2.4k

Featured

See All Featured
A415db3ac9e9668acbc1fb36eead84ac?s=48 mthomps
44
2.5k
3d6ace9554821d552146413bcdf874f6?s=48 trishagee
37
4.9k
78b475797a14c84799063c7cd073962f?s=48 holman
451
140k
Dafc4723e9a1c067796c0fec6f509774?s=48 lemiorhan
633
49k
7cbd3f5f922d798cc312eaf596de7ae6?s=48 iamctodd
30
2.9k
9fa239b3154a0169d99ab7bf1422dd12?s=48 marcelosomers
224
15k
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
263
11k
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
122
5.1k
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
612
56k
245cee81a9c424266e5e401d844ea881?s=48 lara
27
3.4k
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
58
3.8k
E190023b66e2b8aa73a842b106920c93?s=48 zenorocha
302
40k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: mantianxing0111@yahoo.co.jp

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ mantianxing0111@yahoo.co.jp 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: 21449497@qq.com