Linux Smart Enumeration - tool for pentesting and CTFs


First, a couple of useful oneliners ;)

wget "" -O;chmod 700

curl "" -Lo;chmod 700

Note that since version 2.10 you can serve the script to other hosts with the -S flag!


Linux enumeration tools for pentesting and CTFs

This project was inspired by and uses many of its tests.

Unlike LinEnum, lse tries to gradualy expose the information depending on its importance from a privesc point of view.

What is it?

This shell script will show relevant information about the security of the local Linux system, helping to escalate privileges.

From version 2.0 it is mostly POSIX compliant and tested with shellcheck and posh.

It can also monitor processes to discover recurrent program executions. It monitors while it is executing all the other tests so you save some time. By default it monitors during 1 minute but you can choose the watch time with the -p parameter.

It has 3 levels of verbosity so you can control how much information you see.

In the default level you should see the highly important security flaws in the system. The level 1 (./ -l1) shows interesting information that should help you to privesc. The level 2 (./ -l2) will just dump all the information it gathers about the system.

By default it will ask you some questions: mainly the current user password (if you know it ;) so it can do some additional tests.

How to use it?

The idea is to get the information gradually.

First you should execute it just like ./ If you see some green yes!, you probably have already some good stuff to work with.

If not, you should try the level 1 verbosity with ./ -l1 and you will see some more information that can be interesting.

If that does not help, level 2 will just dump everything you can gather about the service using ./ -l2. In this case you might find useful to use ./ -l2 | less -r.

You can also select what tests to execute by passing the -s parameter. With it you can select specific tests or sections to be executed. For example ./ -l2 -s usr010,net,pro will execute the test usr010 and all the tests in the sections net and pro.

Use: ./ [options]

  -c           Disable color
  -i           Non interactive mode
  -h           This help
  -l LEVEL     Output verbosity level
                 0: Show highly important results. (default)
                 1: Show interesting results.
                 2: Show all gathered information.
  -s SELECTION Comma separated list of sections or tests to run. Available
                 usr: User related tests.
                 sud: Sudo related tests.
                 fst: File system related tests.
                 sys: System related tests.
                 sec: Security measures related tests.
                 ret: Recurren tasks (cron, timers) related tests.
                 net: Network related tests.
                 srv: Services related tests.
                 pro: Processes related tests.
                 sof: Software related tests.
                 ctn: Container (docker, lxc) related tests.
               Specific tests can be used with their IDs (i.e.: usr020,sud)
  -e PATHS     Comma separated list of paths to exclude. This allows you
               to do faster scans at the cost of completeness
  -p SECONDS   Time that the process monitor will spend watching for
               processes. A value of 0 will disable any watch (default: 60)
  -S           Serve the script in this host so it can be retrieved
               from a remote host.

Is it pretty?

Usage demo

Also available in webm video


Level 0 (default) output sample


Level 1 verbosity output sample


Level 2 verbosity output sample



Direct execution oneliners

bash <(wget -q -O - -l2 -i

bash <(curl -s -l1 -i

Buy me a beer

Feel free to buy me a beer if this script was useful ;)


Original repository:


April 23, 2021
Notify of
1 Comment
Oldest Most Voted
Inline Feedbacks
View all comments
Muhammad Asim
Muhammad Asim
2 years ago

Nice information. I love hacking

Last edited 2 years ago by Muhammad Asim
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023

Download Free eBook

Step 1 of 4


We’re committed to your privacy. Hakin9 uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.