unhide
forensic tool to find hidden processes and ports
Command lineSystem
Not tested on a device yet. What that means
Commands in the package
unhideunhide-linuxunhide-posixunhide-tcpunhide_rb
About unhide
From Debian's package description
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp.
unhide detects hidden processes using the following six techniques:
- Compare /proc vs /bin/ps output
- Compare info gathered from /bin/ps with info gathered by walking thru the procfs.
- Compare info gathered from /bin/ps with info gathered from syscalls (syscall scanning).
- Full PIDs space occupation (PIDs bruteforcing)
- Reverse search, verify that all thread seen by ps are also seen by the kernel (/bin/ps output vs /proc, procfs walking and syscall)
- Quick compare /proc, procfs walking and syscall vs /bin/ps output
unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.
This package can be used by rkhunter in its daily scans.
This package is useful for network security checks, in addition to forensics investigations.
From Debian's description of the unhide package, under that package's license.
Dependencies
Depends on
Related apps
- startparrun processes in parallel and multiplex their outputCommand line
- sleuthkittools for forensics analysis on volume and filesystem dataCommand line
- unhide.rbForensics tool to find processes hidden by rootkitsCommand line
Task Manager (lxtask)Manage running processes- foremostforensic program to recover lost filesCommand line
- dcflddenhanced version of dd for forensics and securityCommand line
Sources and licenses
- Name: the Debian package name.
- Summary: Debian's short description of the unhide package, under that package's license.
- Description: Debian's description of the unhide package, under that package's license.
- Versions and sizes: Debian's archive for ARM64, as on packages.debian.org.
- Popularity: Debian Popularity Contest counts.
More in About the catalog.