Every flag with purpose, when to use it, performance impact and an example.
By LinPEAS Guide Editorial TeamReviewed by Security Review DeskLast reviewed 2026-09-136 min read
Quick answer
LinPEAS flags fall into execution (-a, -e, -V), performance (-s, -z), selection (-o, -T, -f), output (-N, -q, -w), credentials (-P), debugging (-D) and network recon (-t, -d, -p, -i, -F). The full table below is verified against the current release.
ⓘNote
Reviewed against release 20260908-dffb9496 on 2026-09-13. Commands may change between releases — check ./linpeas.sh -h for your exact build.
General
Flag
Purpose
When to use
Performance
Example
Notes
-h
Show the built-in help/usage message and exit.
Always run this first on your downloaded copy to see the exact options your build supports.
Instant.
./linpeas.sh -h
Flag names and defaults can change between releases; the help text is authoritative for your file.
-M
Force MacPEAS execution.
Running the macOS check set explicitly.
No impact.
./linpeas.sh -M
MacPEAS is auto-selected when uname reports Darwin.
-L
Force LinPEAS execution.
Forcing the Linux check set (for example on an unusual uname).
No impact.
./linpeas.sh -L
Opposite of -M.
-n
Documented as: do not check hostname and IP in known malicious lists and leaks.
You want to skip the external hostname reputation lookup.
No impact.
./linpeas.sh -n
IMPORTANT: in the release we reviewed, -n is listed in help and handled in the case block but is missing from the getopts option string, so './linpeas.sh -n' actually prints help and exits. Do not rely on it to prevent outbound connections; verify against your build with -h and test in a lab.
Execution
Flag
Purpose
When to use
Performance
Example
Notes
-a
Run all checks except the API-key regexes. Enables extra enumeration, the ~1 minute process monitor, the su brute force, and the online vulnerability lookup.
Authorized deep audits and CTF boxes where noise and time are acceptable.
Longest. README indicates roughly 5-10 minutes; real time depends on the host.
./linpeas.sh -a
The su brute force is noisy and only runs when you are not root, timeout exists, and su works without a TTY. Combine with -r for the most intensive scan.
-e
Perform extra enumeration checks that are skipped by default.
You want more coverage than the default but not the full -a workload.
Longer than default.
./linpeas.sh -e
Adds slower, more verbose checks in several sections.
-V
Send the package/kernel inventory to the HackTricks online service for a vulnerability lookup.
You have authorization to make outbound connections and want online CVE matching.
Adds a network request (15s timeout).
./linpeas.sh -V
Implied by -a. Sends host data to an external service; see the safety guide before using in scoped engagements.
Performance
Flag
Purpose
When to use
Performance
Example
Notes
-s
Stealth and superfast. Skips time-consuming checks and does not write to disk.
Fragile or monitored systems, or a quick first pass.
Fastest. Also shortens the internet-connectivity timeout.
./linpeas.sh -s
Skips the deep file/password searches and disables the hostname reputation lookup.
-z <n>
Set the number of threads for background checks.
Tuning speed vs load on the target.
Higher values can be faster but noisier; must be an integer >= 1.
./linpeas.sh -z 4
Default is the detected CPU count, falling back to 2. Recent addition; confirm with -h.
Search
Flag
Purpose
When to use
Performance
Example
Notes
-r
Enable the API-key and secret regex searches across the filesystem.
Hunting for credentials/keys during an authorized engagement.
Very slow. The help text warns it can take from minutes to hours.
./linpeas.sh -r
Runs the api_keys_regex section, which is otherwise skipped.
Selection
Flag
Purpose
When to use
Performance
Example
Notes
-o <checks>
Run only a comma-separated list of sections.
Targeted, faster, quieter audits focused on specific areas.
Much faster than a full run when you pick a few sections.
Run only checks tagged with the given MITRE ATT&CK technique IDs.
Mapping enumeration to specific ATT&CK techniques or purple-team scenarios.
Depends on how many checks match.
./linpeas.sh -T T1057,T1082
A parent technique (T1552) also matches its sub-techniques (T1552.001). Present in recent builds; confirm with -h.
-f <folder>
Analyse a folder (for example extracted firmware) instead of scanning the live system.
Offline firmware or mounted-filesystem review.
Scoped to the folder.
./linpeas.sh -f /mnt/firmware
Forces a fixed set of file/permission/regex checks and enables regexes.
Credentials
Flag
Purpose
When to use
Performance
Example
Notes
-P <password>
Supply a password used for 'sudo -l' and for brute-forcing other users via 'su'.
You already know a valid password (e.g. your own) and want sudo/su checks to use it.
Adds su attempts.
./linpeas.sh -P 'MyKnownPassword'
The password may appear in your shell history and process list. Prefer this only in controlled lab/CTF contexts.
Debugging
Flag
Purpose
When to use
Performance
Example
Notes
-D
Debug mode: print checks that found nothing and how long each check took.
Diagnosing slow runs or verifying which checks executed.
Adds timing output; slightly more verbose.
./linpeas.sh -D
Useful with the troubleshooting workflow.
Output
Flag
Purpose
When to use
Performance
Example
Notes
-N
Disable ANSI colours.
Saving to a plain file, feeding a parser, or terminals that mangle escape codes.
No impact.
./linpeas.sh -N > linpeas.txt
Without -N, save with a tool that preserves colour and read back with 'less -r'.
-q
Suppress the ASCII banner.
Cleaner logs and reports.
No impact.
./linpeas.sh -q
Cosmetic.
-w
Wait for Enter between major blocks of checks.
Reading output interactively section by section.
Pauses execution for input.
./linpeas.sh -w
Not suitable for unattended or piped runs.
Network recon
Flag
Purpose
When to use
Performance
Example
Notes
-t
Run automatic network and internet-connectivity scans. This option writes to files.
Authorized internal network reconnaissance.
Adds scanning time and disk writes.
./linpeas.sh -t
Network recon is out of scope for a pure local privesc audit; use only with explicit authorization.
-d <IP/NETMASK>
Discover live hosts with fping or ping.
Authorized host discovery on a subnet.
Depends on subnet size.
./linpeas.sh -d 192.168.0.1/24
If you use -d/-p/-i without -t, no privilege-escalation checks are performed.
-p <ports>
Ports to scan with nc, combined with -d or -i.
Authorized port scanning.
Depends on port list.
./linpeas.sh -d 192.168.0.1/24 -p 22,80,443
Defaults to 22,80,443,445,3389 plus any you add when used with -d.
-i <IP>
Scan a single IP with nc (top-1000 nmap ports by default).
Authorized single-host port scan.
Depends on ports.
./linpeas.sh -i 127.0.0.1 -p 80,443
Combine with -p to choose ports.
-F <L_IP:L_PORT:R_IP:R_PORT>
Forward a local port to a remote IP:port.
Authorized pivoting scenarios.
Runs a forwarding process.
./linpeas.sh -F 127.0.0.1:8080:10.0.0.5:80
Advanced; only for scoped engagements.
⚠The -n flag does not work as documented
Watch out for -n: it is documented in the help text (“do not check hostname & IP in known malicious lists”) but is missing from the option parser in the release we reviewed, so ./linpeas.sh -n prints help and exits instead of disabling the lookup. Do not rely on it. See is LinPEAS safe?
The table below pairs common situations with sensible flags; for the shortest possible reference keep the cheat sheet open, and build an exact command with the command builder.