Using LinPEAS in OSCP-style exams: methodology

Why manual-first wins exams#

Automated enumeration is fast, but exams reward understanding: you need to explain each step in your report, and LinPEAS output alone does not teach you why a finding is exploitable. The manual pass also keeps you moving when a target is slow, noisy, or when you want to stay quiet. Think of it as two sweeps:

1. Sweep 1 — by hand (10–15 min): id; sudo -l; uname -a, SUID binaries, cron jobs, kernel version, interesting files. Write down everything, even "boring" output.
2. Sweep 2 — LinPEAS: run it (consider -s for speed on slow targets), then compare its highlights against your notes. Anything LinPEAS flags that you didn't is your next lead; anything you found that it didn't is why sweep 1 exists.

Triage under time pressure#

Exam time is finite. Work the findings in this order:

1. 1

2. 2

3. 3

4. 4

LinPEAS flags worth knowing for exams#

• -s — faster/stealthier run when the target is slow or you want less noise.
• -o — run only selected check groups when you need one section re-checked quickly.
• -q — quieter output for logging to a file you will read later.
• Save everything: ./linpeas.sh | tee /tmp/linpeas.txt so the evidence survives a dropped shell.

Exam-day checklist#

• OffSec's current exam guide read — tool rules confirmed for your exam version.
• Manual enumeration notes template ready (identity, sudo, SUID, cron, kernel, files).
• LinPEAS transfer method tested (curl/wget/python http.server) before the clock starts.
• Screenshot and note-taking workflow decided in advance.
• Report structure sketched so documentation happens during the exam, not after.

A note-taking template that survives the exam#

Examiners grade what you document. For every finding you investigate, record the same five fields:

• What you ran (exact command) and when.
• What the output showed (paste the relevant lines).
• What you concluded (vector, dead end, or needs more work).
• What you tried next (the exploit command or the reason you moved on).
• A screenshot or output file reference for the report.

Knowing when to move on#

The hardest exam skill is abandoning a lead. Set a personal timebox per vector (say, 30–45 minutes for a single privesc path): if you have not made progress when it expires, document where you got to and switch to the next candidate. LinPEAS usually gives you several leads — the exam is won by the candidate who works the list, not the one who falls in love with the first red line.