Quick answer

Grab linpeas.sh from the official GitHub release with curl -L .../linpeas.sh -o linpeas.sh, read it, make it executable with chmod +x, then run ./linpeas.sh | tee linpeas.out on a host you are authorised to test. This walkthrough covers each step and the mistakes people hit along the way.

This is a practical companion to our reference pages. If you want the pure reference, go to download & verify, what is linpeas.sh, and the full installation guide. Here we walk the whole thing end to end.

Authorised use only

Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.

Step 1 — Find LinPEAS on GitHub#

LinPEAS is part of the PEASS-ng project. A search for linpeas github or github linpeas should land you at github.com/peass-ng/PEASS-ng. Don’t download the raw script from random mirrors — the ready-to-run files are attached to each entry on the releases page.

Step 2 — Download linpeas.sh#

On the machine you’re testing (or your own box, to transfer it over), pull the latest script:

Download the latest linpeas.sh from GitHub
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
# no curl? use wget:
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -O linpeas.sh

Not sure which file to grab? linpeas.sh is the right default; the linpeas.sh explainer covers the small and fat variants and the compiled binaries.

Step 3 — Read it before you run it#

This is the step most tutorials skip. linpeas.sh is plain text — open it, or at least confirm it came from the official releases URL and is about a megabyte.

Review the script
less linpeas.sh
wc -l linpeas.sh
Warning

You’ll also see the one-liner curl -L .../linpeas.sh | sh everywhere. It works, but it runs code you never saw. Download-and-review is the safer habit — see is LinPEAS safe?

Step 4 — Run your first scan#

Run and save at once
chmod +x linpeas.sh
./linpeas.sh | tee linpeas.out

A default run takes a few minutes and prints colour-coded sections. Piping through tee shows it on screen and saves a copy at the same time. Read the saved copy back with colours:

Re-read the saved output with colours
less -r linpeas.out

For every way to keep the results — plain text, timestamped files, /dev/shm, or HTML/PDF — see saving LinPEAS output to a file.

Step 5 — Make sense of what you see#

Colour marks how interesting a line is, not whether it’s exploitable. Start with red/yellow, and remember green means “common,” not “safe.” Our output guide and colour codes explain how to read a real scan, and each finding links to the concept behind it (like SUID or sudo).

Common mistakes#

  • Permission denied — add the execute bit (chmod +x) or run sh linpeas.sh; on a noexec filesystem, run from /dev/shm.
  • Saved file full of ^[[ codes — you saved colours to a plain file; read with less -r or save with -N.
  • The download vanishes — antivirus/EDR often quarantines enumeration scripts; expect alerts on monitored hosts.
  • Running as root — LinPEAS is meant to run as a normal user to find ways to root; as root it skips those checks.

More fixes are on the troubleshooting page.

Note

One spelling note: it’s LinPEAS / linpeas.sh, often mistyped as linepeas, linpease or linpeass — all the same tool. Verified against release 20260908-dffb9496 on 2026-09-13.

Sources & references

  1. PEASS-ng repository
  2. PEASS-ng releases — reviewed 20260908-dffb9496
  3. linPEAS README