Quick answer

Download: curl -L …/linpeas.sh -o linpeas.sh. Run: ./linpeas.sh. Fast: -s. Deep: -a. Secrets: -r. Target: -o <section>. Save colour: | tee out. Save plain: -N > out. Help: -h. Run only on systems you are authorised to test.

Note

Flag names and defaults can change between releases. Everything here is verified against release 20260908-dffb9496; confirm with ./linpeas.sh -h on your copy.

Download & run#

The four commands you will type most
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee linpeas.out
less -r linpeas.out

Most-used flags#

FlagDoes
-hHelp for your build
-sStealth & fast (skips slow checks)
-aAll checks: 1 min process monitoring, su bruteforce, extra checks (noisy)
-eExtra enumeration
-rSecret/API-key regexes (slow — minutes to hours)
-o <list>Only these sections
-T <list>Only checks matching MITRE ATT&CK technique(s)
-P <pwd>Password for sudo -l / su checks
-NNo colours (clean report file)
-qNo banner
-DDebug / timing
-z <N>Threads for background checks
-VOnline vulnerability lookup (outbound request)
-f <folder>Password/permission recon inside a folder (+ regexes)

Sections for -o#

system_information, container, cloud, procs_crons_timers_srvcs_sockets,
network_information, users_information, software_information,
interesting_perms_files, interesting_files, api_keys_regex

The privesc-critical trio for a first pass: users_information,interesting_perms_files,interesting_files — sudo, SUID, writable files and credentials in one quick run.

Recipes#

Copy-paste recipes
# Quiet first pass (fragile or monitored host)
./linpeas.sh -s

# Focus on privesc-critical areas
./linpeas.sh -o users_information,interesting_perms_files

# Deep lab scan with secrets
./linpeas.sh -a -r | tee linpeas.out

# Clean report file, no colours
./linpeas.sh -N > linpeas.txt

# Password-assisted (authorised, password known)
./linpeas.sh -P 'KnownPassword'

# Only MITRE T1057/T1082-relevant checks
./linpeas.sh -T T1057,T1082

The first five minutes: triage workflow#

When the output lands, work in this order — it mirrors how experienced testers read a LinPEAS report:

  1. Search for red/yellow lines first — high-confidence vectors.
  2. Check sudo (sudo -l section): NOPASSWD or abusable binaries win fastest.
  3. Check SUID/SGID: cross-reference highlighted binaries with GTFOBins.
  4. Check writable cron scripts / timers / service files: scheduled root execution.
  5. Check credentials: history, configs, keys — then lateral options.
  6. Only then consider kernel CVEs — verify patch level, last resort.

Full method: how to read LinPEAS output.

Colour legend (memorise this)#

Red/yellow = 95%+ confidence privesc vector — investigate immediately. Red = suspicious, verify. Green = known-good by name (content may still be misconfigured — verify). Blue / cyan = informational. Full legend: LinPEAS colours.

Saving and sharing output#

Output hygiene
./linpeas.sh | tee linpeas.out   # keep colours; read back with less -r
./linpeas.sh -N > linpeas.txt    # plain text for reports
shred -u linpeas.out             # securely delete when done (contains secrets)
Warning

LinPEAS output routinely contains credentials. Redact before sharing, store it only where the engagement allows, and delete it from the target afterward.

Common mistakes#

  • Running -a -r on a production host — noisy, slow, writes temp files. Use -s for a first pass.
  • Trusting a kernel CVE flag without checking the distro changelog (backported patches).
  • Forgetting that curl | sh executes unreviewed code — download and review first outside labs.
  • Saving output with secrets to a shared location.
  • Assuming green means safe — it means “known-good by name”; verify content.

Frequently asked questions#

What is the single most useful LinPEAS command?

For a first authorised pass: ./linpeas.sh -s — fast and quiet. For a deep lab audit: ./linpeas.sh -a -r | tee linpeas.out. Most daily work lives between those two.

How do I run LinPEAS on just one area?

Use -o with a section name, e.g. ./linpeas.sh -o users_information,interesting_perms_files for the privesc-critical areas. See the sections list above.

Why is my LinPEAS run so slow?

You are probably running -a (all checks incl. 1-minute process monitoring) or -r (filesystem-wide regexes). Use -s for speed, or scope with -o.

How do I keep the colours when saving output?

Pipe through tee (./linpeas.sh | tee linpeas.out) and read back with less -r. Redirecting with > alone keeps colour codes too, but -N gives clean plain text for reports.

Is there an interactive way to build the command?

Yes — the LinPEAS command builder on this site lets you pick a mode, options and sections and copies the resulting command.

Note

Build the exact command interactively with the command builder. Verified against 20260908-dffb9496.

LinPEAS section map#

Every -o section maps to a part of the output. Learn this map and you can target any audit precisely instead of re-running everything:

SectionCoversPrivesc value
system_informationKernel, OS, hostname, protections, exploit registryKernel CVE leads (verify patch level)
containerDocker/LXC detection, breakout conditionsContainer escape paths
cloudInstance metadata and cloud credentialsHighest blast radius — scope carefully
procs_crons_timers_srvcs_socketsProcesses, cron, timers, services, socketsScheduled root execution
network_informationInterfaces, ports, firewall, connectivity probesLocal-only services to pivot into
users_informationUsers, groups, sudo, passwords, SSHSudo rules, reusable creds
software_informationPackages, versions, sudo versionVersion-based CVEs
interesting_perms_filesSUID/SGID, writable files, ACLsThe classic privesc hunting ground
interesting_filesConfigs, histories, keys, backupsCredentials and misconfigurations
api_keys_regexFilesystem-wide secret regexes (-r)API keys — slow but thorough

When not to run LinPEAS#

  • On a production host without explicit written approval — -a is noisy and writes temp files.
  • With -V when outbound traffic is out of scope — it sends an inventory to an external service.
  • With -r when you are short on time — regexes can run for hours on large filesystems.
  • Piped straight from the internet (curl | sh) on anything but a lab — download and review the script first.
  • When a lighter question would do — a single sudo -l answers “can I sudo?” faster than a full scan.

One-line triage commands#

Saved the output? These one-liners pull the signal out of a long report:

Triage a saved report
grep -iE 'red|99%' linpeas.out | head -40      # highest-confidence lines
grep -iE 'sudo|NOPASSWD' linpeas.out            # sudo findings
grep -iE 'suid|sgid' linpeas.out                # SUID/SGID findings
grep -iE 'writable' linpeas.out                 # writable files/scripts
grep -iE 'password|passwd|key|token' linpeas.out  # credential hits (handle carefully)

The cheat sheet is designed to be useful on a second monitor, but if you print it: use landscape, and keep the flags reference open alongside — flags change between releases and paper does not update itself. Re-print after each PEASS-ng release you standardise on. A stale cheat sheet is worse than none when flags change between releases.

Sources & references

  1. linPEAS README — commands and parameters
  2. PEASS-ng releases — help text verified against 20260908-dffb9496