Jump to letter: [ A B C D E F G H I J K L M N O P R S T U V W ]

unhide - Tool to find hidden processes and TCP/UDP ports from rootkits

Description:

Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
rootkits, Linux kernel modules or by other techniques. It includes two
utilities: unhide and unhide-tcp.

Unhide detects hidden processes using six techniques:

 - compare /proc vs /bin/ps output
 - compare info gathered from /bin/ps with info gathered by walking
   thru the procfs
 - compare info gathered from /bin/ps with info gathered from syscalls
 - full PIDs space ocupation (PIDs bruteforcing)
 - compare /bin/ps output vs /proc, procfs walking and syscall
 - quick compare /proc, procfs walking and syscall vs /bin/ps output

Unhide-TCP identifies TCP/UDP ports that are listening but not listed in
sbin/ss or /bin/netstat using two methods:

 - brute force of all TCP/UDP ports availables and compare with SS/netstat
   output
 - probe of all TCP/UDP ports not reported by netstat

Packages

- new upstream version (beta)

Listing created by Repoview-0.7.0