LinPEAS prints a legend at the top of every run. Red/yellow = 95% a privilege-escalation vector; red = worth a look; green = common items matched by name (not “safe”); light cyan = users with a shell; blue = users without a shell and mounted devices; light magenta = your username.
The colour legend#
| Colour | Runtime legend | How to read it |
|---|---|---|
| Red/Yellow | 95% a privilege-escalation vector (runtime legend). The README phrases this as 99%. | Highest-interest finding. Investigate first, then manually verify. |
| Red | You should take a look into it. | Suspicious configuration that may lead to escalation. Needs manual review. |
| Green | Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs). | Matched as commonly-seen BY NAME, not verified as safe by content. Green does not mean secure. |
| Light Cyan | Users with console (shell). | Accounts that can log in interactively. |
| Blue | Users without console and mounted devices. | Informational grouping. |
| Light Magenta | Your username. | Highlights the current user in the output. |
This table reflects the legend printed by release 20260908-dffb9496. LinPEAS shows this legend itself when you run it — it is the authoritative source for your build.
The 95% vs 99% detail#
You will see two different figures depending on where you look. The runtime legend in the current release says red/yellow is “95% a PE vector.” The project README phrases the same idea as “99% sure.” Neither is a promise: both mean “very likely worth your time,” and both still require manual verification. We quote the runtime legend because it is what your terminal actually prints.
The most important misconception#
Green does not mean “secure.” The runtime legend defines green as common things — users, groups, SUID/SGID, mounts, .sh scripts, cron jobs — matched by name, not by content. A green line can still be part of a real escalation path. Do not skip green findings on the assumption they are safe.
This is exactly where many third-party guides are wrong: they describe green as “safe” and red as “vulnerable.” LinPEAS colours communicate priority and category, not a security verdict.
Reading colours in saved output#
Colours are ANSI escape codes. To keep them when saving:
./linpeas.sh | tee linpeas.out
less -r linpeas.out # -r renders the coloursFor a colourless file (e.g. to paste into a report or feed a parser), disable them:
./linpeas.sh -N > linpeas.txtDo not rely on colour alone. If you are colour-blind or reading a mono file, use the section titles and the ATT&CK tags to orient yourself, and read the words around each finding rather than just the highlight.
Sources & references
- linPEAS README (Colors section) — colour legend
- PEASS-ng release — runtime legend verified against 20260908-dffb9496
- PEASS-ng parsers — JSON/HTML/PDF output tooling