1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Source: unhide
Section: admin
Priority: extra
Maintainer: Debian Forensics <forensics-devel@lists.alioth.debian.org>
Uploaders: Christophe Monniez <christophe.monniez@fccu.be>
Build-Depends: debhelper (>= 7.0.50~), quilt (>= 0.46-7~)
Standards-Version: 3.8.4
Homepage: http://www.security-projects.com/?Unhide
Vcs-Browser: http://git.debian.net/?p=debian-forensics/unhide.git
Vcs-Git: git://git.debian.net/git/debian-forensics/unhide.git
Package: unhide
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}
Suggests: rkhunter
Description: Forensic tool to find hidden processes and ports
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
rootkits, Linux kernel modules or by other techniques. It includes two
utilities: unhide and unhide-tcp.
.
unhide detects hidden processes using three techniques:
* comparing the output of /proc and /bin/ps
* comparing the information gathered from /bin/ps with the one gathered from
system calls (syscall scanning)
* full scan of the process ID space (PIDs bruteforcing)
.
unhide-tcp identifies TCP/UDP ports that are listening but are not listed in
/bin/netstat through brute forcing of all TCP/UDP ports available.
.
This package can be used by rkhunter in its daily scans.
|
