- Name: unhide
- Version: 1.0
- Release: 10.fc18.20121229
- Epoch:
- Group: Applications/System
- License: GPLv3
- Url: http://www.unhide-forensics.info/
- Summary: Tool to find hidden processes and TCP/UDP ports from rootkits
- Architecture: x86_64
- Size: 63291
- Distribution: Fedora Project
- Vendor: Fedora Project
- Packager: Fedora Project
Description:
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
rootkits, Linux kernel modules or by other techniques. It includes two
utilities: unhide and unhide-tcp.
Unhide detects hidden processes using three techniques:
- comparing the output of /proc and /bin/ps
- comparing the information gathered from /bin/ps with the one gathered
from system calls (syscall scanning)
- full scan of the process ID space (PIDs bruteforcing)
unhide-tcp identifies TCP/UDP ports that are listening but are not listed
in /bin/netstat through brute forcing of all TCP/UDP ports available.
- BuildArch:
- ExcludeArch:
- ExclusiveArch:
- Cookie: buildvm-15.phx2.fedoraproject.org 1374832425
- Buildhost: buildvm-15.phx2.fedoraproject.org
Generated packages:
Other version of this rpm:
