The strongest LinPEAS alternatives are linux-smart-enumeration (maintained, staged verbosity) and, historically, LinEnum. For specific jobs, pair LinPEAS with linux-exploit-suggester (kernel exploits), pspy (live process/cron watching) or Lynis (defensive auditing). No single tool sees everything — combining them reduces blind spots.
linux-smart-enumeration
Maintained; gradual verbosity levels 0/1/2. Great for a quiet, staged approach.
LinEnum
Classic and light, but its default branch is unmaintained since 2020.
linux-exploit-suggester
Focuses on kernel-exploit suggestions from the kernel version. Embedded inside LinPEAS.
pspy
Watches processes and cron activity in real time without root. Complements LinPEAS.
Lynis
Auditing/hardening tool aimed at defenders and compliance, not just privesc.
unix-privesc-check
Older POSIX privesc checker; useful on legacy Unix, but largely unmaintained.
Manual enumeration vs. automated tools#
Automated scripts are fast and thorough, but they are noisy, can be flagged by security software, and only report what they were written to look for. Manual enumeration is quieter and context-aware but slow and easy to do incompletely. The practical answer is both: run a tool to map the terrain quickly, then verify and dig manually. Our privesc checklist supports the manual side.
How to choose#
| If you want… | Reach for |
|---|---|
| Breadth in one run, container/cloud coverage | LinPEAS |
| A quiet, staged first pass | LSE |
| Kernel-exploit suggestions | linux-exploit-suggester (also embedded in LinPEAS) |
| Live process/cron discovery without root | pspy |
| Defensive auditing / hardening reports | Lynis |
Sources & references
- PEASS-ng (LinPEAS) — reviewed 20260908-dffb9496
- LinEnum repository — maintenance status checked 2026-09-13
- linux-smart-enumeration repository
- pspy repository