Quick answer
LinPEAS looks for secrets in many places: config files, shell history, logs, backups, SSH keys, and process memory. With -r it also runs regex searches across the filesystem for API keys and hashes (the api_keys_regex section) — powerful but slow.
Where it appears#
Credential searches are spread across Users Information, Software Information and Other Interesting Files, with the dedicated regex section (api_keys_regex) enabled by -r.
╔══════════╣ Searching passwords in history files
.bash_history: mysql -u root -pSuperSecret
╔══════════╣ Searching ssl/ssh files
/home/user/.ssh/id_rsa (private key, readable)How to read it#
- Treat any surfaced credential as sensitive — and as a potential lateral/vertical move.
- Private keys, database passwords in history, and
.env/config secrets are common wins. - The regex section (
-r) is noisy and slow; expect false positives among real hits.
Warning
Saved output can contain these secrets verbatim. Store it only where your engagement allows, redact before reporting, and delete it from the target afterward. See reading the output.
Verify it yourself#
grep -RiaE 'password|passwd|secret' ~/.bash_history 2>/dev/null
ls -la ~/.ssh/ /home/*/.ssh/ 2>/dev/null
find / -name '*.env' 2>/dev/nullSources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation