bruteforcing

Unhide is a little handy forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. This tools works under both Linux / Unix, and MS-Windows operating systems. From the man page:

It detects hidden processes using three techniques:

1. The proc technique consists of comparing /proc with the output of /bin/ps.
2. The sys technique consists of comparing information gathered from /bin/ps with information gathered from system calls.
3. The brute technique consists of bruteforcing the all process IDs. This technique is only available on Linux 2.6 kernels.

{ 14 comments }