unhide - Unhide is a forensic tool to find hidden processes and TCP/UDP ports.
| Website: | http://www.security-projects.com/?Unhide |
|---|---|
| License: | GPLv3+ |
| Vendor: | Atomicorp http://www.atomicorp.com |
- Description:
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp. Unhide detects hidden processes using three techniques: - comparing the output of /proc and /bin/ps - comparing the information gathered from /bin/ps with the one gathered from system calls (syscall scanning) - full scan of the process ID space (PIDs bruteforcing) unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.
Packages
| unhide-20130526-4.el6.art.i686 [562 KiB] |
Changelog
by Support (2013-06-18):
- Update to 20130526 |
Package contents (click to display)
[f] /usr/share/unhide/LEEME.txt
[f] /usr/share/unhide/README.txt [d] /usr/share/unhide [f] /usr/man/man8/unhide-tcp.8.gz [f] /usr/man/man8/unhide.8.gz [f] /usr/bin/unhide [f] /usr/bin/unhide-tcp |
| unhide-20130428-3.el6.art.i686 [561 KiB] |
Changelog
by Support (2013-03-28):
- Update to 20130428 |
Package contents (click to display)
[f] /usr/share/unhide/LEEME.txt
[f] /usr/share/unhide/README.txt [d] /usr/share/unhide [f] /usr/man/man8/unhide-tcp.8.gz [f] /usr/man/man8/unhide.8.gz [f] /usr/bin/unhide [f] /usr/bin/unhide-tcp |