Package: unhide (20220611-1) [debports]

[ Source:  ]

forensic tool to find hidden processes and ports

Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp.

unhide detects hidden processes using the following six techniques:

  * Compare /proc vs /bin/ps output
  * Compare info gathered from /bin/ps with info gathered by walking thru the
    procfs.
  * Compare info gathered from /bin/ps with info gathered from syscalls
    (syscall scanning).
  * Full PIDs space occupation (PIDs bruteforcing)
  * Reverse search, verify that all thread seen by ps are also seen by the
    kernel (/bin/ps output vs /proc, procfs walking and syscall)
  * Quick compare /proc, procfs walking and syscall vs /bin/ps output

unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

This package can be used by rkhunter in its daily scans.

This package is useful for network security checks, in addition to forensics investigations.

Other Packages Related to unhide

• dep: iproute2

  networking and traffic control tools

• dep: libc6 (>= 2.34)

  GNU C Library: Shared libraries
  also a virtual package provided by libc6-udeb

• dep: lsof

  utility to list open files

• dep: net-tools

  NET-3 networking toolkit

• dep: procps

  /proc file system utilities

• dep: psmisc

  utilities that use the proc file system

• sug: rkhunter

  rootkit, backdoor, sniffer and exploit scanner

Download unhide

Download for all available architectures

Architecture	Package Size	Installed Size	Files
hppa (unofficial port)	55.4 kB	142.0 kB	[list of files]