The most common questions in one place: LinPEAS is free, open-source, runs as a normal user, does not exploit anything, and highlights leads rather than confirmed vulnerabilities. A default run does make outbound connections, so only use it where authorised.
Is LinPEAS safe to use?
It is open-source and read-only by default, but a default run makes outbound connections and security software may flag it. Only run it where authorised. See our full safety guide.
Does LinPEAS require root?
No. It is designed to run as a normal user to find privilege-escalation paths. Running as root skips those checks.
Is LinPEAS free?
Yes, it is free and open-source under the GNU GPL (v2 or later, with clarifications in the project LICENSE).
Who maintains LinPEAS?
Carlos Polop and open-source contributors, as part of the PEASS-ng project.
Does LinPEAS exploit vulnerabilities?
No. It enumerates and highlights potential vectors. Exploitation is a separate, manual step you perform only where authorised.
Does a red finding mean the box is vulnerable?
No. Colour indicates how interesting a line is. Red/yellow means very likely worth checking, not confirmed exploitable. Always verify manually.
How long does LinPEAS take to run?
The README indicates roughly 4 minutes by default and 5-10 minutes with -a, but real time depends heavily on the host, filesystem size and options.
Does LinPEAS work on macOS?
Yes. On macOS it automatically runs the MacPEAS check set. See our macOS guide.
Is this the official LinPEAS website?
No. This is an independent educational resource. The official project is at github.com/peass-ng/PEASS-ng.
Can LinPEAS detect every vulnerability?
No. It focuses on local misconfiguration and post-access enumeration, and it can both miss issues and flag harmless ones. Treat it as one input, not a verdict.
What is the difference between linpeas.sh, linpeas_fat.sh and linpeas_small.sh?
linpeas.sh has all checks with only linux-exploit-suggester embedded (the default); linpeas_fat.sh embeds additional third-party tools for offline use; linpeas_small.sh keeps only the most important checks for a smaller, quieter run.
Do I need internet access to run LinPEAS?
No, the core checks are local. But by default it tries to reach external services for connectivity and vulnerability lookups; those simply report as unavailable if there is no connectivity.
Sources & references
- PEASS-ng official repository — project source and README
- PEASS-ng latest releases — reviewed release 20260908-dffb9496
- HackTricks: Linux privilege escalation — referenced by LinPEAS output