Unix / Linux Running Processes Information

Generated report details the running processes on the target machine at scan time. This plugin is informative only and could be used for forensic investigation, malware detection, and to confirm that your system processes conform to your system policies. TRUSTED...

[SECURITY] Fedora 28 Update: procps-ng-3.3.12-2.fc28

The procps package contains a set of system utilities that provide system information. Procps includes ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch and pwdx. The ps command displays a snapshot of running processes. The top command provides a repetitive update of the...

Blast from the past: stowaway Virut delivered with Chinese DDoS bot

Recently, we described an unusual Chinese drive-by attack that was delivering a variant of the Avzhan DDoS bot. The attack also contained multiple components that were not-so-new. Among the exploits, the newest was from 2016. Avzhan is also not a recent malware—the compilation timestamp of the...

LinEnum v0.6 - Scripted Local Linux Enumeration and Privilege Escalation Checks

LinEnum will automate many of the checks that I’ve documented in the Local Linux Enumeration & Privilege Escalation Cheatsheet. It’s a very basic shell script that performs over 65 checks, getting anything from kernel information to locating possible escalation points such as potentially useful...

Mobile Triada and Horde Variants Bypass Android Security

Two mobile variants of Triada and Horde malware have been spotted in the wild by Check Point Software Technologies researchers who warn the latest samples have adopted dangerous new techniques including the ability to evade Google’s security on some OS versions. The Android Trojan called Triada,...

Python Based Windows Backdoor with Gmail C&C: gDog

A stealthy Python based Windows backdoor that uses Gmail as a command and control server Gdog is a stealthy Python Windows backdoor that uses Gmail as a command and control server. It is mostly inspired by Gcat with which it shares code base but it adds additional options and features and goes...

Android OS Access Bypass Information Disclosure

The vulnerability of the getRunningAppProcesses function in the Android operating system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and obtain information about running processes through a specially crafted...

CVE-2014-0240

The modwsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes...

CVE-2014-0240

The modwsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes...

[SterJo NetStalker v.1.0] Security software able to detect all authorized and unauthorized connections

SterJo NetStalker is innovative and FREE security software able to detect all authorized and unauthorized connections to your computer and send you alert for each new connection. The software is based on similar principles as most firewalls work and also could create a custom security policies wi...

Volatility 2.0 - Advanced Memory Forensics [With Video Demonstration]

Volatility 2.0 - Advanced Memory Forensics With Video Demonstration The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques ar...

Nmap NSE net: snmp-processes

Attempts to enumerate running processes through SNMP. SYNTAX: snmpcommunity: The community string to use. If not given, it is ''public'', or whatever is passed to 'buildPacket'. OpenVAS Vulnerability Test $Id: gbnmapsnmpprocessesnet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrappe...

backorifice-info NSE Script

Connects to a BackOrifice service and gathers information about the host and the BackOrifice service itself. The extracted host information includes basic system setup, list of running processes, network resources and shares. Information about the service includes enabled port redirections,...