Quick answer

LinPEAS is safe in the sense that it is open-source, read-only by default, and does not exploit anything. But “safe” has caveats: a default run makes outbound network connections, security software may flag it, and running any tool on a system you do not own can be illegal. Read the source, understand the network behaviour, and only run it where authorised.

Read this first

The single most overlooked fact about LinPEAS: a default run contacts external services. If your engagement forbids outbound traffic from the target, plan for this before you run it.

Why LinPEAS is generally safe#

  • Open-source. Every check is readable shell script. You can audit it before running.
  • Read-only by default. It does not modify system configuration, and by default does not write findings to disk.
  • No exploitation. It enumerates and highlights; it never attempts to escalate privileges itself.
  • No install. It is a single script with no dependencies to add to the system.

The caveats that matter#

1. It makes outbound network connections by default

Based on the source of release 20260908-dffb9496, a default run performs these network actions:

  • Host-checker request. At the start of the System Information section, if curl or wget is present, LinPEAS POSTs JSON to tools.hacktricks.wiki/api/host-checker (15-second timeout). By default it sends the hostname, a source tag and the version. With -V or -a it also sends OS, kernel and the installed package inventory for an online vulnerability lookup.
  • Internet-connectivity probes. The Network Information section tests outbound access by connecting to 1.1.1.1 and 104.18.74.230 over TCP 80/443, sending an ICMP ping, and making a raw DNS query. This is how it reports whether the host has internet access.
  • Hostname reputation. If HTTPS works and stealth mode is off, it checks whether the public IP/hostname appears in known malicious lists or leaks.
The -n flag caveat

The help text lists a -n flag to “not check hostname & IP in known malicious lists.” In the release we reviewed, -n is missing from the option-parsing string, so ./linpeas.sh -n actually prints help and exits — it does not disable the connections. Do not rely on it. Verify against your build and, if you must prevent outbound traffic, control it at the network or run in an isolated environment.

Stealth mode (-s) shortens the connectivity timeouts and skips the hostname reputation lookup, but the connectivity probes and host-checker behaviour are part of the default run. Always test in a lab first if network behaviour matters to your engagement.

2. Security software may flag it

Antivirus and EDR products frequently flag enumeration scripts. In our own testing, Windows Defender quarantined the downloaded linpeas.sh within seconds — not because it is malware, but because its content matches enumeration and credential-search patterns. On a monitored target, running LinPEAS is likely to generate alerts. See troubleshooting if your download disappears.

3. Legality and authorisation

Authorised use only

Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.

Running a privilege-escalation enumeration tool on a system you do not own or are not authorised to test can be a criminal offence in many jurisdictions, regardless of intent. Authorisation is not optional.

How to run LinPEAS responsibly#

  1. 1

    Confirm authorisation

    Own the system, or have written permission / a CTF or lab that permits testing.

  2. 2

    Download and read it

    Prefer downloading and reviewing the script over piping it straight into a shell. See the download & verify guide.

  3. 3

    Account for network behaviour

    Decide whether outbound connections are acceptable. If not, isolate the environment; do not assume -n disables them.

  4. 4

    Choose the right intensity

    Use -s for a quiet first pass and reserve -a/-r for labs where noise is acceptable.

  5. 5

    Clean up afterwards

    Remove any saved output and the script itself when your authorised audit is done.

Is LinPEAS malware?

No. It is an open-source security auditing tool. Antivirus may flag it because it resembles enumeration and credential-searching activity, but the source is public and readable.

Does LinPEAS send my data anywhere?

By default it sends the hostname and version to a HackTricks host-checker endpoint, and probes external IPs to test connectivity. With -V or -a it also sends OS, kernel and package details. Review the source and your rules of engagement before running.

Can I stop LinPEAS from connecting out?

Not reliably with a flag in the build we reviewed (the -n flag does not work as documented). Control outbound traffic at the network level or run in an isolated environment.

Is it safe to run LinPEAS as root?

It will run, but it is designed to run as a normal user to find ways to become root. As root it skips those checks and some steps take longer.

Sources & references

  1. PEASS-ng official repository — project source and README
  2. PEASS-ng latest releases — reviewed release 20260908-dffb9496
  3. HackTricks: Linux privilege escalation — referenced by LinPEAS output