BSD Ports

security/unhide 20210124_1 DragonFly

Forensic tool to find hidden processes and TCP/UDP ports

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv3
Categories
security
Package size
129.3 KiB, 516.6 KiB installed

Description

Unhide is a forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. It consists of two programs: unhide and unhide-tcp.

unhide detects hidden processes through: * Comparison of /proc vs /bin/ps output. * Comparison of info gathered from /bin/ps with info gathered from. * Syscalls (syscall scanning). * Full PIDs space ocupation (PIDs bruteforcing).

unhide-tcp identifies TCP/UDP ports that are listening but not listed in /bin/netstat by doing brute forcing of all TCP/UDP ports availables.

In the other systems

SystemPortVersion
DragonFlysecurity/unhide20210124_1
FreeBSDsecurity/unhide20210124_1

Install

Binary package:

pkg install unhide

From DPorts:

cd /usr/dports/security/unhide && make install clean

Dependencies

No port depends on this one.