getcap capabilities enum

getcap -r / 2>/dev/null

Lists binaries with POSIX capabilities (cap_setuid, cap_dac_read_search, cap_net_bind_service...) across the entire system. A misassigned capability on an interpreted binary (python, perl, ruby) is a one-line root escalation.

When classic enumeration (sudo, SUID) yields nothing. Capabilities are overlooked in audits: if someone assigned cap_setuid+ep to python3 or cap_dac_read_search to tar, you have a clean vector that LinPEAS sometimes misses on old kernels. I always check this on hardened hosts.

If the system is very large, the full -r / takes time and generates noise: scope it to /usr, /opt, and /home. Also don't waste time if the binary with the capability is a native binary without documented abusable functions: capabilities only escalate if the binary lets you execute code.