The more experienced a hacker becomes, the harder they are to detect. Beginners are often noisy and leave plenty of traces behind. As they gain experience, they learn to think like defenders and understand how detection actually works.
Today, we’re going to look at a tool that can hide your processes. It’s Zapper. We’ve already seen reports of it being used by hackers to masquerade their long running processes and make them look legitimate.
What is Zapper?
Zapper is a tool created by Hacker’s Choice. Unlike a lot of crude hiding methods, it actually works well. Zapper doesn’t need root privileges to run and it can work even as a static binary, one you can rename too.
Not only can you hide the command line itself, but the environment variables of a process too, along with what’s in /proc/<PID>/environ. The tool doesn’t depend on LD_PRELOAD or libc tricks, it uses ptrace() to manipulate the ELF Auxiliary Vector instead. The performance overhead is tiny, so you won’t even notice it.
Using Zapper
First you need to get the binary. Let’s use the command from the project repository:
Defenders often monitor traffic and certain keywords may trigger alerts. So it’s best to rename the tool and then host it on your C2.
bash$ > mv zapper systemd-control
Here we renamed the binary to systemd-control. On many Linux distros, the actual systemd components live inside /lib/systemd, so placing the renamed file there and changing the timestamps can make it hard to catch, unless someone’s monitoring that directory too. That’s basically why you as a defender can’t rely purely on filename based detection.
The help menu has plenty of examples and shows some creative ways you can use the tool:
bash$ > ./systemd-control -h
Hackers can hide binaries along with their child processes. They can create hidden tmux sessions to maintain persistence on a server without showing up in normal process listings. They can also leave the program name exposed but strip all the command line options, making the process look generic.
For the demonstration we’ll hide an nmap scan and all its arguments:
bash$ > exec ./systemd-control -f -a '[kworker/2:2-events_power_efficient]' nmap IP -Pn -sV -sC > /dev/shm/scan.txt &
This command makes it look like a kernel worker thread. Most admins would just ignore it. While it’s running, you won’t find it anywhere with ps or any other tool. The scan results were saved in /dev/shm/scan.txt, that proves it worked.
bash$ > ps aux | grep nmap
# no nmap in ps
bash$ > cat scan.txt
You should try it on a pentest to emulate a realistic threat and see whether defenders can catch it.
Summary
Zapper can help when you need to hide a suspicious long running process. It masquerades them as something legitimate that every admin would just skip past. The commands and arguments can’t be found in /proc either. You don’t need root to work with it, so it’s suitable for a lot of engagements. With all these qualities, it gained popularity fast and has already been seen in DFIR reports on cyberattacks.
If you like Linux and want to advance your skills, consider joining our Advanced Linux for Hackers training.
Many of us are being pushed toward insecure messengers and social networks. These communication channels may be monitored and are not trustworthy. That does not mean private communication is impossible. Far from it. One of the oldest and most practical problems in cryptography is how to send a secret message through an open channel without making the message obvious to anyone who sees it. And that problem has already been solved very well.
The encrypted text does not always have to look like encrypted text. A message can be hidden in plain sight so that it looks like ordinary content, or it can be embedded inside something else entirely, such as audio, video, or text that does not raise suspicion. That is the realm of steganography. Cryptography protects the meaning. Steganography helps hide the fact that a message exists at all.
For most people, though, the real need is much simpler. They want a practical and convenient way to encrypt messages quickly and reliably. So let’s look at some easy tools that make that possible.
Workflow
The workflow is always the same. First, the sender and recipient agree on a secret password or passphrase. A short sentence made up of several words is often better than a single word because it is easier to remember and usually much stronger. Then the sender pastes the message into the tool, clicks Encrypt, enters the password, and sends the resulting encrypted text through whatever channel they want, even if that channel is insecure. The recipient then uses the same tool and the same password to decrypt the message.
That is the basic pattern, and it stays consistent across different tools and platforms.
Web-Based Encryption Tools
There are browser-based applications that can encrypt text very effectively, and they are often the easiest place to begin. But there is one very important detail. You want to make sure the encryption happens entirely on the client side. That means the message is processed inside your browser, on your own machine, and the password never leaves your device. If the server never sees the key, the risk of leakage is much lower.
That point is worth checking. A good looking website is not automatically secure. One way to verify local processing is to monitor browser traffic using Developer Tools, or DevTools, and see whether your password is being sent over the network. Another way is to use a firewall application such as Little Snitch and observe whether the service tries to communicate with remote servers during encryption or decryption. If the system is truly local, the encrypted message can later be decrypted either through the same browser-based Decrypt form or offline with OpenSSL.
There are a few websites out there.
The first one is Encrypt Online. It uses AES-256-CBC to encrypt text, strings, JSON, YAML and config data directly in your browser. It’s considered to be a strong, mathematically unbreakable encryption algorithm.
Paranoia Text Encryption uses AES-256 in EAX mode with keys derived from passwords using Argon2. That combination is strong and modern.
LOCK.PUB is another browser-based option, focused on creating encrypted online notes, polls, images, audio and a lot more. The content can only be accessed with the correct password.
For users who want something more flexible and technical, GCHQ CyberChef is a powerful open-source option from the UK’s GCHQ intelligence agency. It supports many encryption and encoding operations.
AES Utils is another choice, using AES-256-GCM with PBKDF2 while keeping the interface simple.
Warning
As a contrast, it is useful to look at what should not be considered a proper secure solution. MagicTool encrypts and decrypts text without requiring a password.
At first glance that may sound convenient, but from a cryptographic point of view it means the same built-in secret is used every time. If anyone knows the website and the service’s behavior, they may be able to infer or recover the messages. In that setup, the tool itself is functioning like the secret key simply by existing.
That is not a strong cryptographic model. However, in some situations, “encryption” without a user-provided key could still serve a purpose. For example, it might be used to deceive an adversary into believing you are an inexperienced user who does not know how to encrypt messages properly, when your real objective is to feed them specific information in a controlled manner.
Offline Encryption Software
Browser tools are convenient, but sometimes you want something local, traditional, and fully under your control. Linux, Windows, and macOS all have native or widely trusted applications that can encrypt text and files without relying on a remote browser service.
Common examples include command-line tools such as GnuPG, OpenSSL, and ccrypt, along with password managers, VeraCrypt, Cryptomator, and a wide range of similar utilities. These tools are often used not only for text messages but also for file encryption, container protection, and secure storage.
Offline tools have an advantage because they reduce the number of outside systems involved in the process. You are not dependent on a remote website staying available, and you do not need to trust a third-party server with your content or password. For many users, that is a better model from a privacy perspective. At the same time, it is important to understand that privacy tools still leave traces. On a Windows system, a digital forensics investigator may be able to see installation artifacts, program execution history, registry keys, recent files, shortcut files, jump lists, user activity traces, prefetch data and remnants of encrypted containers or text editors. Even when the content itself remains protected, the fact that you used a particular application may still be visible in the system’s history.
That is why privacy-conscious users often prefer systems that are designed to leave fewer traces by default. A privacy-oriented operating system, live environment, or hardened Linux distribution can be a better choice when your goal is to reduce unnecessary local exposure.
Summary
Encrypting messages is a simple and useful privacy skill. Whether you use a browser-based tool or you prefer offline software the basic principle is the same.
The right tool depends on the situation. Browser-based tools are convenient and fast. Offline tools give you more independence and more control. Some systems are designed for strong cryptography, while others are only suitable for demonstration or deceptive use. Understanding the difference matters.
If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.
Login
