How to use Dismember to scan memory and search for sensitive information

This tool is developed in Go language and is currently in active development. It may eventually evolve into a complete penetration testing tool.

Tool requirements

This tool is developed in Go language, so we first need to install and configure the Go language environment on the local device. Next, researchers can use the following command to clone the source code of this project to the local machine:

git clone https://github.com/liamg/dismember.git

or directly access the project's【Releases page】Download the latest version of the Dismember code and add it to the environment variable PATH.

Tool commands

This tool can use the grep command to match regular expressions in all memory for all (accessible) processes, which can be used to find sensitive data in memory, identify processes based on the content contained in memory, or query the memory of processes to obtain interesting information. The scan command includes many built-in patterns and can effectively act as a sensitive data scanner for machine memory.

Dismember can be used to search the memory of all processes it accesses, so running it as root is the most effective method. In addition, this tool also provides features such as process enumeration, process status acquisition, process information collection, and drawing process trees.

Main commands

Command	Description
grep	Search for process memory data based on a given string or regular expression
scan	Search for process memory data based on predefined sensitive data patterns

Utility tool commands

Command	Description
files	Display the list of files accessible by the process
find	Search for the PID of a given process name, and return the first match if multiple processes are found
info	Display relevant information about the target process
kernel	Display kernel information
kill	Terminate the execution of one or more processes using SIGKILL
list	Enumerate all processes in the target system
resume	Resume suspended processes using SIGCONT
suspend	Suspend a process using SIGSTOP
tree	Display the process tree of a process and all its child processes

Tool usage

Search for a pattern match in the target process by PID

Search for memory information in process 1234 (PID):

dismember grep -p 1234 'the password is .*'

Search for a pattern match in the target process by process name

Search for memory-related information of process 'nginx':

dismember grep -n nginx 'username=liamg&password=.*'

Search for a pattern match in all processes

Search for GitHub API tokens in all processes:

dismember grep 'gh[pousr]_[0-9a-zA-Z]{36}'

Search for sensitive information in the memory of all processes

Search for common sensitive information in the memory of all accessible processes:

dismember scan

Tool usage demonstration

license agreement

The development and release of this project followMITOpen source license agreement.

Project address

Dismember：【GitHub link】

你可能想看：

A brief discussion on how to ensure the security of information assets during the termination of information systems

Ensure that the ID can be accessed even if it is guessed or cannot be tampered with; the scenario is common in resource convenience and unauthorized vulnerability scenarios. I have found many vulnerab

Announcement regarding the addition of 7 units as technical support units for the Ministry of Industry and Information Technology's mobile Internet APP product security vulnerability database

How to conduct offensive and defensive exercise risk assessment for AI systems： Red Teaming Handbook

A brief discussion on how key information infrastructure operators should revise and improve security management systems

A Brief Discussion on the Establishment of Special Security Management Organizations for Operators of Key Information Infrastructure

b) It should have the login failure handling function, and should configure and enable measures such as ending the session, limiting the number of illegal logins, and automatically exiting when the lo

b) It should have a login failure handling function, and should configure and enable measures such as ending the session, limiting the number of illegal login attempts, and automatically logging out w

Data security can be said to be a hot topic in recent years, especially with the rapid development of information security technologies such as big data and artificial intelligence, the situation of d

Internal and external cultivation ｜ Under the high-confrontation offensive and defensive, internal network security cannot be ignored

最后修改时间：2025-03-29 20:31:44