1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
Source: unhide
Section: admin
Priority: extra
Maintainer: Francois Marier <francois@debian.org>
Build-Depends: debhelper (>= 6)
Standards-Version: 3.8.0
Homepage: http://www.security-projects.com/?Unhide
Vcs-Svn: svn://svn.debian.org/svn/collab-maint/deb-maint/unhide/
Vcs-Browser: http://svn.debian.org/wsvn/collab-maint/deb-maint/unhide/
Package: unhide
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}
Suggests: rkhunter
Description: Forensic tool to find hidden processes and ports
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
rootkits, Linux kernel modules or by other techniques. It includes two
utilities: unhide and unhide-tcp.
.
unhide detects hidden processes using three techniques:
- comparing the output of /proc and /bin/ps
- comparing the information gathered from /bin/ps with the one gathered
from system calls (syscall scanning)
- full scan of the process ID space (PIDs bruteforcing)
.
unhide-tcp identifies TCP/UDP ports that are listening but are not listed in
/bin/netstat through brute forcing of all TCP/UDP ports available.
.
This package can be used by rkhunter in its daily scans.
|
