Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishi...

Avatar for Tomoyuki KOYAMA Tomoyuki KOYAMA
August 14, 2018
Technology
1
180

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Avatar for Tomoyuki KOYAMA

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
Reading HTTP Client Hints
Avatar for Tomoyuki KOYAMA tomoyk
0
87
Log message with JSON item count for root cause analysis in microservices
Avatar for Tomoyuki KOYAMA tomoyk
1
210
Distributed Log Search Based on Time Series Access and Service Relations
Avatar for Tomoyuki KOYAMA tomoyk
0
330
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
Avatar for Tomoyuki KOYAMA tomoyk
0
420
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
Avatar for Tomoyuki KOYAMA tomoyk
2
920
この先生きのこるための学び方 / how-to-learn-tech
Avatar for Tomoyuki KOYAMA tomoyk
1
400
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
Avatar for Tomoyuki KOYAMA tomoyk
0
180
パケットを覗いてみよう / Packet workshop for beginners
Avatar for Tomoyuki KOYAMA tomoyk
0
340
XSSの入力値を調べてみた / searching xss insertion value
Avatar for Tomoyuki KOYAMA tomoyk
3
1.5k

Other Decks in Technology

See All in Technology
ACA でMAGI システムを社内で展開しようとした話
Avatar for Yuji Masaoka | まっぴぃ mappie_kochi
1
250
20250929_QaaS_vol20
Avatar for Shin Murakami mura_shin
0
110
Why React!?? Next.jsそしてReactを改めてイチから選ぶ
Avatar for ypresto ypresto
10
4.4k
PLaMo2シリーズのvLLM実装 / PFN LLM セミナー
Avatar for Preferred Networks pfn
PRO
2
970
GA technologiesでのAI-Readyの取り組み@DataOps Night
Avatar for yuto16 yuto16
0
270
バイブコーディングと継続的デプロイメント
Avatar for nwiizo nwiizo
2
420
動画データのポテンシャルを引き出す！ Databricks と AI活用への奮闘記（現在進行形）
Avatar for Databricks Japan databricksjapan
0
140
PLaMoの事後学習を支える技術 / PFN LLMセミナー
Avatar for Preferred Networks pfn
PRO
9
3.8k
Access-what? why and how, A11Y for All - Nordic.js 2025
Avatar for Geisy Domiciano gdomiciano
1
110
AI時代だからこそ考える、僕らが本当につくりたいスクラムチーム / A Scrum Team we really want to create in this AI era
Avatar for TAKAKING22 takaking22
6
3.4k
職種別ミートアップで社内から盛り上げる アウトプット文化の醸成と関係強化/ #DevRelKaigi
Avatar for Ichiro Nishiuma nishiuma
2
130
From Prompt to Product @ How to Web 2025, Bucharest, Romania
Avatar for Jan Werner janwerner
0
120

Featured

See All Featured
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
431
66k
Music & Morning Musume
Avatar for Bryan Veloso bryan
46
6.8k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1371
200k
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
185
22k
It's Worth the Effort
Avatar for 3n 3n
187
28k
Unsuck your backbone
Avatar for Amy Palamountain ammeep
671
58k
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
237
140k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
269
13k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
Avatar for Eileen M. Uchitelle eileencodes
26
3.1k
Designing for Performance
Avatar for Lara Hogan lara
610
69k
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
110k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
34
6.1k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: [email protected]

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ [email protected] 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: [email protected]