Kali Linux

Dismember : Scan Memory For Secrets And More

Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes (or particular ones) for common secrets and custom regular expressions, among other things.

It will eventually become a full /proc toolkit.

Using the grep command, it can match a regular expression across all memory for all (accessible) processes. This could be used to find sensitive data in memory, identify a process by something included in its memory, or to interrogate a processes’ memory for interesting information.

There are many built-in patterns included via the scan command, which effectively works as a secret scanner against the memory on your machine.

Dismember can be used to search memory of all processes it has access to, so running it as root is the most effective method.

Commands are also included to list processes, explore process status and related information, draw process trees, and more…

Main Commands

CommandDescription
grepSearch process memory for a given string or regex
scanSearch process memory for a set of predefined secret patterns

Utility Commands

CommandDescription
filesShow a list of files being accessed by a process
findFind a PID given a process name. If multiple processes match, the first one is returned.
infoShow information about a process
kernelShow information about the kernel
killKill a process (or processes) using SIGKILL
listList all processes currently available on the system
resumeResume a suspended process using SIGCONT
suspendSuspend a process using SIGSTOP (use ‘dismember resume’ to leave suspension)
treeShow a tree diagram of a process and all children (defaults to PID 1).

Installation

Grab a binary from the latest release and add it to your path.

Usage Examples

Search for a pattern in a process by PID

# search memory owned by process 1234
dismember grep -p 1234 'the password is .*'

Search for a pattern in a process by name

# search memory owned by processes named "nginx" for a login form submission
dismember grep -n nginx 'username=liamg&password=.*'

Search for a pattern across all processes

# find a github api token across all processes
dismember grep 'gh[pousr]_[0-9a-zA-Z]{36}'

Search for secrets in memory across all processes

# search all accessible memory for common secrets
dismember scan
R K

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

1 day ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

1 day ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

1 day ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

1 day ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

1 day ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

1 day ago