linpeas.sh is the shell-script form of LinPEAS — the file you download and run to enumerate a Linux, Unix or macOS host. It is written in portable /bin/sh, has no dependencies, and is the default artifact on the PEASS-ng releases page. There are three script variants plus compiled binaries.
If you just want the file, jump to the download page; for the complete step-by-step run, see the installation guide. This page explains what linpeas.sh actually is and which variant to pick.
What is linpeas.sh?#
It is a single, self-contained shell script. Because it targets /bin/sh syntax, it runs almost anywhere a POSIX shell exists — Debian, Ubuntu, CentOS, Alpine, FreeBSD, OpenBSD and macOS — without installing anything. When you run it, it works through its checks and prints colour-coded findings; by default it writes nothing to disk. Everything LinPEAS does lives in this one file.
$ file linpeas.sh
linpeas.sh: POSIX shell script, ASCII text executable
$ head -1 linpeas.sh
#!/bin/shlinpeas.sh vs linpeas_fat.sh vs linpeas_small.sh#
The releases page publishes three script variants. All are .sh files; they differ in what they embed and therefore in size and speed.
| Variant | Contains | Trade-off |
|---|---|---|
linpeas.sh | All checks; only linux-exploit-suggester embedded | The default — full coverage, reasonable size. |
linpeas_small.sh | Only the most important checks | Smallest and quietest; less coverage. |
linpeas_fat.sh | All checks + extra third-party tools (base64) | Largest; best when fully offline. |
Most people should use plain linpeas.sh. Reach for linpeas_small.sh when transfer size or noise matters, and linpeas_fat.sh only when the target has no internet and you want the embedded extras.
linpeas.sh (script) vs the compiled binary#
PEASS-ng also ships compiled binaries (linpeas_linux_amd64, linpeas_darwin_arm64, and so on). They do the same checks; the difference is how they launch.
| linpeas.sh (script) | Compiled binary | |
|---|---|---|
| Needs a shell | Yes (/bin/sh) | No |
| Readable before running | Yes — plain text you can audit | No — opaque executable |
| Size | ~1 MB | Several MB |
| Best when | You want to review it, or no matching binary | No usable shell, or you prefer a single executable |
Because it is readable, the script is the more auditable choice — you can open it before you run it, which the safety guide recommends.
How to get and run linpeas.sh#
The short version (full detail on the installation guide):
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh # download
less linpeas.sh # review it
chmod +x linpeas.sh # make executable
./linpeas.sh # runTo keep a copy of the results, see saving LinPEAS output to a file.
Is it “linpeas” or “linpeas.sh”?#
Both refer to the same tool. linpeas.sh is the file name. “LinPEAS” is the tool’s name. On Kali Linux the PEASS-ng package also installs a linpeas command on your PATH that runs the packaged linpeas.sh for you. It is also frequently mistyped as linepeas, linpease or linpeass — all the same script.
Verified against PEASS-ng release 20260908-dffb9496.
Is linpeas.sh safe to run?
It is open-source and read-only by default, but a default run makes some outbound connections and antivirus may flag it. Review the script and only run it where authorised. See our safety guide.
Do I need to chmod linpeas.sh?
Only if you run it as ./linpeas.sh. You can skip the execute bit by running it through a shell: sh linpeas.sh.
Can I run linpeas.sh without saving it to disk?
Yes, with curl -L
Where is linpeas.sh on Kali Linux?
The peass package installs it at /usr/share/peass/linpeas/linpeas.sh, and adds a linpeas command to your PATH.
Sources & references
- PEASS-ng releases — reviewed 20260908-dffb9496
- linPEAS README — download and usage commands
- Kali peass-ng package — package name and paths