Paketti: unhide (20100201-1)

[ Source: unhide  ]

Forensic tool to find hidden processes and ports

Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp.

unhide detects hidden processes using three techniques:

 * comparing the output of /proc and /bin/ps
 * comparing the information gathered from /bin/ps with the one gathered from
   system calls (syscall scanning)
 * full scan of the process ID space (PIDs bruteforcing)

unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

This package can be used by rkhunter in its daily scans.

Tagit: Implemented in: C, User Interface: Command Line, Role: Program, Scope: Utility, Security: Forensics, Intrusion Detection

Muut pakettiin unhide liittyvät paketit

• sug: rkhunter

  rootkit, backdoor, sniffer and exploit scanner

Imuroi unhide

Imurointi kaikille saataville arkkitehtuureille

Arkkitehtuuri	Paketin koko	Koko asennettuna	Tiedostot
amd64	802.8 kt	1,828.0 kt	[tiedostoluettelo]
armel	717.6 kt	1,556.0 kt	[tiedostoluettelo]
i386	752.0 kt	1,668.0 kt	[tiedostoluettelo]
ia64	1,274.8 kt	3,580.0 kt	[tiedostoluettelo]
mips	841.1 kt	2,072.0 kt	[tiedostoluettelo]
mipsel	834.7 kt	2,072.0 kt	[tiedostoluettelo]
powerpc	844.7 kt	1,868.0 kt	[tiedostoluettelo]
s390	819.8 kt	1,752.0 kt	[tiedostoluettelo]
sparc	804.5 kt	1,812.0 kt	[tiedostoluettelo]