Quick answer

Choose a base mode (default, stealth, extra or all checks), toggle options like secret regexes or no-colour, optionally limit to specific sections, and copy the generated command. This builder covers auditing and enumeration workflows only — run LinPEAS only on systems you are authorised to test.

Note

This tool builds enumeration/auditing commands only. It does not generate exploitation or network-attack commands. Run LinPEAS only on systems you are authorised to test — see our security policy.

1. Base mode
2. Options
3. Limit to sections (optional, uses -o)
Generated command 
./linpeas.sh

Standard audit. Colour output; read it back with less -r if you save it.

How to use the result#

  1. Download LinPEAS first (see the installation guide).
  2. Copy the generated command and run it from the directory containing linpeas.sh.
  3. If you enabled saving, read colour output with less -r or open the plain .txt file.
  4. Interpret the results with the output guide.

Presets for common scenarios#

Not sure which options to pick? Start from one of these presets, then adjust in the builder above:

ScenarioPreset commandWhy
Quick triage, fragile host./linpeas.sh -sStealth/fast: skips time-consuming checks, minimal footprint
Standard authorised audit./linpeas.shDefault run — balanced coverage and speed
Privesc-focused pass./linpeas.sh -o users_information,interesting_perms_filesOnly sudo/SUID/writable-file/credential sections — fastest path to vectors
Deep lab / CTF audit./linpeas.sh -a | tee linpeas.outAll checks incl. 1-min process monitoring and su bruteforce; noisy
Deep audit + secret hunting./linpeas.sh -a -r | tee linpeas.outAdds filesystem-wide API-key/password regexes — slow, thorough
Clean report for delivery./linpeas.sh -N > linpeas.txtNo colours or banner — plain text for reports (redact secrets first)
Password known (authorised)./linpeas.sh -P 'KnownPassword'Unlocks sudo -l and su-based checks; mind shell history
MITRE-mapped assessment./linpeas.sh -T T1057,T1082Runs only checks mapped to those ATT&CK techniques
Folder-scoped recon./linpeas.sh -f /opt/appPassword/permission recon inside one folder (+ regexes, limited checks)

Choosing options deliberately#

  • Intensity: -s (fast) → default → -e (extra) → -a (everything, noisy). Match intensity to how fragile or monitored the host is.
  • Secrets: add -r only when you have time — it can take minutes to hours on large filesystems.
  • Scope: -o limits to named sections; -T limits by MITRE technique; -f scopes to a folder.
  • Output: | tee keeps colours for interactive reading; -N gives clean text for reports.
  • Online lookups: -V sends an inventory outbound — only with explicit approval (see is LinPEAS safe?).
  • Network recon: -t/-d/-p/-i turn LinPEAS into a scanner — separate scope decision.
Warning

A generated command is a starting point, not a substitute for judgement. Re-read what each flag does on the flags reference before running it against anything that matters — especially -a, -r and -V.

If the generated command misbehaves#

SymptomLikely causeFix
Permission deniedMissing execute bit or noexec mountchmod +x linpeas.sh; or sh linpeas.sh; or copy to /dev/shm
Hangs for a long time-a process monitoring or -r regexesWait it out, or re-run with -s / scoped -o
No output at allVery old sh or truncated downloadRe-download, verify size, try bash linpeas.sh
Colours broken in saved fileRedirect strips nothing — your pager doesRead with less -r, or re-run with -N
./linpeas.sh -n prints helpKnown quirk: -n is missing from the option parserDo not rely on -n; see the safety page
Sudo/su checks skippedNo password available to the scriptSupply -P (authorised, mind history)

Flag combinations that conflict#

  • -s with -a — contradictory intents (fast vs everything); -a wins, so do not combine them.
  • -d/-p/-i without -t — runs only the network scan, no privesc checks. Add -t for both.
  • -f <folder> limits the check set — do not expect full-system coverage from a folder-scoped run.
  • -N with | tee — fine, but you lose colours; pick one output strategy.
  • -r with -o api_keys_regex — the focused way to run secret regexes without the full scan.

From builder to muscle memory#

Use the builder while learning; graduate to typing the five commands that cover 95% of real audits:

The five commands to memorise
./linpeas.sh -s                                        # quick triage
./linpeas.sh                                            # standard audit
./linpeas.sh -o users_information,interesting_perms_files # privesc focus
./linpeas.sh -a -r | tee linpeas.out                    # deep lab scan
./linpeas.sh -N > linpeas.txt                           # clean report

Once these are reflexes, the builder becomes what it is meant to be — a reference for the unusual cases (-T, -f, -F) rather than a daily driver.

Bookmark the flags reference#

The builder covers the common cases; the flags reference documents every flag including the network recon set (-t, -d, -p, -i, -F) and port-forwarding — the options deliberately left out of this builder because they are separate scope decisions.

Stuck on output? Read how to read LinPEAS output or grab the cheat sheet.

Sources & references

  1. linPEAS README — commands and parameters
  2. PEASS-ng releases — help text verified against 20260908-dffb9496