Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishi...

Avatar for Tomoyuki KOYAMA Tomoyuki KOYAMA
August 14, 2018
Technology
1
180

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Avatar for Tomoyuki KOYAMA

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

See All by Tomoyuki KOYAMA
Reading HTTP Client Hints
Avatar for Tomoyuki KOYAMA tomoyk
0
85
Log message with JSON item count for root cause analysis in microservices
Avatar for Tomoyuki KOYAMA tomoyk
1
200
Distributed Log Search Based on Time Series Access and Service Relations
Avatar for Tomoyuki KOYAMA tomoyk
0
320
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
Avatar for Tomoyuki KOYAMA tomoyk
0
420
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
Avatar for Tomoyuki KOYAMA tomoyk
2
910
この先生きのこるための学び方 / how-to-learn-tech
Avatar for Tomoyuki KOYAMA tomoyk
1
390
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
Avatar for Tomoyuki KOYAMA tomoyk
0
180
パケットを覗いてみよう / Packet workshop for beginners
Avatar for Tomoyuki KOYAMA tomoyk
0
340
XSSの入力値を調べてみた / searching xss insertion value
Avatar for Tomoyuki KOYAMA tomoyk
3
1.5k

Other Decks in Technology

See All in Technology
LLM翻訳ツールの開発と海外のお客様対応等への社内導入事例
Avatar for gree_tech gree_tech
PRO
0
360
実践AIガバナンス
Avatar for Asei Sugiyama asei
3
250
Nstockの一人目エンジニアが 3年間かけて向き合ってきた セキュリティのこととこれから〜あれから半年〜
Avatar for わだよし yo41sawada
0
110
「守る」から「進化させる」セキュリティへ ~AWS re:Inforce 2025参加報告~ / AWS re:Inforce 2025 Participation Report
Avatar for Yuji Oshima yuj1osm
1
180
実運用で考える PGO
Avatar for KNOWLEDGE WORK / 株式会社ナレッジワーク kworkdev
PRO
0
120
Microsoft Fabric のネットワーク保護のアップデートについて
Avatar for Ryoma Nagata ryomaru0825
1
120
Product Management Conference -AI時代に進化するPdM-
Avatar for Yuta Kojima kojima111
0
270
【Grafana Meetup Japan #6】Grafanaをリバプロ配下で動かすときにやること ~ Grafana Liveってなんだ ~
Avatar for よしたけ yoshitake945
0
200
攻撃と防御で実践するプロダクトセキュリティ演習～導入パート～
Avatar for Recruit recruitengineers
PRO
3
1.6k
生成AI時代のデータ基盤
Avatar for shibuiwilliam shibuiwilliam
1
1.1k
そのコンポーネント、サーバー？クライアント？App Router開発のモヤモヤを可視化する補助輪
Avatar for Makoto Tateno makotot
4
770
Understanding Go GC #coefl_go_jp
Avatar for 弁護士ドットコム bengo4com
1
1.1k

Featured

See All Featured
Bash Introduction
Avatar for André Augusto Costa Santos 62gerente
614
210k
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
790
250k
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
48
50k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
351
21k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
332
24k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.5k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
36
6.8k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
8
910
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
179
9.9k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
231
18k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
34
6k

Transcript

  1. ࠤ઒ٸศϑΟογϯά αΠτΛௐ΂ͯΈͨ 2018/08/14 ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018 Tomoyuki KOYAMA

  2. ࣗݾ঺հ • ͜΍· ͱ΋Ώ͖ • ౦ژ޻Պେ 2೥ • શࠃେձ 2017मྃ

    • NOCνϡʔλʔ • PyCon JP ελοϑ Twitter: @tmyk_kym Blog: blog.koyama.me

  3. ͖͔͚ͬ TBHBXBNNDPN

  4. sagawa-mm.com

  5. औಘ/ൺֱ $ curl -s http://www.sagawa-exp.co.jp/
 > white # ਖ਼نαΠτ
 $

    curl -s http://sagawa-mm.com/ 
 > black # ِαΠτ $ vim -d white black # ൺֱ

  6. $ vim -d black white

  7. ൺֱ:ِαΠτʹͷΈଘࡏ <body onclick="
 document.getElementById('downloadapk').click();">
 <a href="sagawa.apk" id="downloadapk" css="display:none;" download="sagawa.apk"></a> ʙলུʙ

    <dd class=“input"><center> <a href="sagawa.apk">
 <div class="toiawaseNo jq-placeholder">
 <font><b>Πϯετʔϧ</b> </div> </a> <p class="note"></p> </dd>

  8. υϝΠϯͷௐࠪ

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ) $ whois sagawa-mm.com ߋ৽೔࣌: 2018-07-18T11:24:40.0Z ొ࿥೔: 2018-07-18T11:24:40.0Z ొ࿥ۀऀ: Chengdu

    west dimension digital technology Co., LTD ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li ొ࿥૊৫: li meng meng ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q ొ࿥ॅॴ2: Meng Cheng Xian ొ࿥༣ศ൪߸: 010000 ొ࿥ࠃ: cn ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ ొ࿥Fax: +86.13614466925 ొ࿥ϝʔϧ: [email protected]

  10. ॴ༗ऀΛௐࠪ • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

  11. 102 Domains whois৘ใʹ [email protected] 
 ؚ͕·ΕΔsagawaܥυϝΠϯ

  12. υϝΠϯͷҰ෦ • sagawa-anu\.com // sagawa-??? • sagawa-expr\.com // expressͷදه •

    saggawa-exp\.com // ΞϧϑΝϕοτॏͶ • sagawa-co-jp\.com // .Λ-Ͱදݱ • sagawajp\.com // ҧ࿨ײ͕ͳ͍

  13. APKϑΝΠϧͷௐࠪ ಈతղੳ

  14. ݕূ؀ڥ/ݕମ • Nexus 7 2013 Wi-Fi • Android 6.0.1 •

    sagawa.apk • sagawa-mm\.comΑΓऔಘ • SHA-256: 580a027109ac70b32e4423623dfff5b4c6d52220a 905125332c0af0e231e0387 ˞஫҆શͳ؀ڥͰ
 ݕূ͍ͯͩ͘͠͞ɻ ݕূ࣌ʹ͸ωοτϫʔΫ ͷִ཭ͳͲे෼ʹ஫ҙ͠ ͍ͯͩ͘͞ɻ

  15. APKϑΝΠϧ - ಈతղੳ(1)

  16. APKϑΝΠϧ - ಈతղੳ(2) όοΫάϥ΢ϯυ
 Ͱ઀ଓΛzҡ࣋z Ṗͷന͍ΞϓϦ͕ ৗற ࠤ઒ٸศ͕ফ͑ͨ

  17. APKϑΝΠϧ - ಈతղੳ(3) Կ΋දࣔ͞Εͣ αʔϏεEH.BJO4FSWJDFΛ
 ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ 4)" BDGBEG CDCEGDEBEEGF GCECGF

  18. APKϑΝΠϧ - ಈతղੳ(4) • tPacketCaptureͰύέοτΩϟϓνϟ ΍ΓऔΓ͕ແ͍

  19. APKϑΝΠϧͷௐࠪ ੩తղੳ

  20. APKΛղੳ(1) 1. apktoolΛΠϯετʔϧ 2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢
 $ apktool d sagawa.apk

  21. APKΛղੳ(2) 1. ϑΝΠϧ classes.dex ΛऔΓग़͢
 $ unzip sagawa.apk 2. dex2jar

    ΛΠϯετʔϧ 3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒
 $ bash d2j-dex2jar.sh ../unziped/classes.dex

  22. APKΛղੳ(3) 1. jarϑΝΠϧΛల։
 $ unzip classes-dex2jar.jar 2. JavaDecompiler ΛΠϯετʔϧ 3.

    JavaDecompiler Ͱ1ͷιʔεΛ։͘

  23. σίϯύΠϥͰιʔεΛಡΉ

  24. ϑΝΠϧҰཡ • gfer/DhsActivity$1.java • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ • tog/essMyApplication$1.java •

    tog/essMyApplication$a.java • tog/vtdMyWebActivity.java • tog/essMyApplication.java • gig/dgMainService.java • a.java • goda/eeftMyReceiver.java
  25. None

  26. ௥Ճ

  27. ଞͷυϝΠϯ • ϝʔϧΞυϨε: [email protected]