Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishi...

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Tomoyuki KOYAMA Tomoyuki KOYAMA
August 14, 2018
Technology
1
200

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Avatar for Tomoyuki KOYAMA

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
Query Prediction for Log Search for Distributed Tracing with External Monitoring Alerts
Avatar for Tomoyuki KOYAMA tomoyk
0
15
Root Cause Analysis for Middleware Issues by Kubernetes Resource Events / KST-2026
Avatar for Tomoyuki KOYAMA tomoyk
0
28
Reading HTTP Client Hints
Avatar for Tomoyuki KOYAMA tomoyk
0
130
Log message with JSON item count for root cause analysis in microservices
Avatar for Tomoyuki KOYAMA tomoyk
1
250
Distributed Log Search Based on Time Series Access and Service Relations
Avatar for Tomoyuki KOYAMA tomoyk
0
380
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
Avatar for Tomoyuki KOYAMA tomoyk
0
460
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
Avatar for Tomoyuki KOYAMA tomoyk
1
1k
検索性能に配慮した複製による分散ログ管理 / DPS-185
Avatar for Tomoyuki KOYAMA tomoyk
0
11
この先生きのこるための学び方 / how-to-learn-tech
Avatar for Tomoyuki KOYAMA tomoyk
1
430

Other Decks in Technology

See All in Technology
Kubernetesにおける推論基盤
Avatar for ry ry
1
380
実践 Datadog MCP Server
Avatar for 株式会社ヌーラボ nulabinc
PRO
2
190
JAWSDAYS2026 [C02] 楽しく学ぼう！AWSとは？AWSの歴史 入門
Avatar for 平賀博司 hiragahh
0
150
us-east-1 に障害が起きた時に、 ap-northeast-1 にどんな影響があるか 説明できるようになろう！
Avatar for Kazuki Miura miu_crescent
PRO
13
4.3k
親子 or ペアで Mashup for the Future！ しゃべって楽しむ 初手AI駆動でものづくり体験
Avatar for hiroramos hiroramos4
PRO
0
120
猫でもわかるKiro CLI(AI 駆動開発への道編)
Avatar for Hiroo Katoh kentapapa
0
200
スクリプトの先へ！AIエージェントと組み合わせる モバイルE2Eテスト
Avatar for Ryo WATANABE error96num
0
170
Agent ServerはWeb Serverではない。ADKで考えるAgentOps
Avatar for 為藤アキラ akiratameto
0
100
PMとしての意思決定とAI活用状況について
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
120
ナレッジワークのご紹介（第88回情報処理学会 ）
Avatar for KNOWLEDGE WORK / 株式会社ナレッジワーク kworkdev
PRO
0
210
楽しく学ぼう！コミュニティ入門 AWSと人が つむいできたストーリー
Avatar for hiroramos hiroramos4
PRO
1
200
Go標準パッケージのI/O処理をながめる
Avatar for matumoto matumoto
0
200

Featured

See All Featured
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.6k
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
160
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
187
22k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
HU Berlin: Industrial-Strength Natural Language Processing with spaCy and Prodigy
Avatar for Ines Montani inesmontani
PRO
0
260
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
16k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
40
2.3k
Java REST API Framework Comparison - PWX 2021
Avatar for Matt Raible mraible
34
9.2k
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
5
770
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
239
140k
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
680

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: [email protected]

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ [email protected] 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: [email protected]