linux-discovery

Enumerates Linux systems for local privilege escalation vectors.

253|37|Updated Feb 22, 2026

Search Tags:#penetration testing #auditing #linux #privilege escalation #enumeration #red teaming

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill linux-discovery

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: linux-discovery
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/privesc/linux-discovery
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill linux-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps penetration testers quickly identify potential pathways to gain higher privileges on a Linux system, streamlining the enumeration process.

Core Features & Use Cases

Comprehensive Enumeration: Scans for misconfigurations, SUID binaries, capabilities, cron jobs, and more.
Attack Surface Mapping: Identifies exploitable vectors for privilege escalation.
Use Case: After gaining initial access to a Linux server, run this Skill to discover if you can escalate from a low-privilege user to root by finding a misconfigured sudo rule or an exploitable kernel vulnerability.

Quick Start

Run the linux-discovery skill to find all potential privilege escalation vectors on the current Linux host.

Frequently Asked Questions about linux-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate a Linux system for local privilege escalation vectors?▼

Linux privilege escalation enumeration checks sudo configurations, SUID/SGID binaries, capabilities, cron jobs, file permissions, and kernel exploits. It maps exploitable attack surfaces to provide actionable findings for security assessments after gaining initial shell access.

What common misconfigurations are checked during Linux privilege escalation auditing?▼

Linux privilege escalation auditing checks for misconfigured sudo rules, vulnerable SUID/SGID binaries, excessive file permissions, and exploitable kernel vulnerabilities. These misconfigurations provide pathways to escalate from a low-privilege user to root access.

Do I need shell access to run Linux enumeration for privilege escalation?▼

Yes, you need shell access and common Linux utilities on the target system to perform local privilege escalation enumeration. This access allows the auditing scripts to check sudo configurations, capabilities, and cron jobs for exploitable attack surfaces.

What is the best way to find SUID binaries and sudo misconfigurations during a red team engagement?▼

The best way to find SUID binaries and sudo misconfigurations is comprehensive Linux enumeration that scans for SUID/SGID binaries, capabilities, and cron jobs. This maps exploitable attack surfaces for actionable findings during red teaming and security assessments.

Can I use automated scripts to map the attack surface on a Linux server after initial access?▼

Yes, you can use automated scripts to map the attack surface on a Linux server after gaining initial access. The scripts enumerate local privilege escalation vectors by checking sudo configurations, file permissions, and kernel exploits to discover root escalation pathways.