kedrich

Bandit is OverTheWire's entry-level wargame, and it's less about "hacking" than about getting genuinely comfortable in a Linux shell. You SSH into a box, and each level hands you the password to the next one — but only if you can coax it out of a filesystem that's actively trying to make that annoying.

I worked through all of Bandit as the first checkpoint in my foundations curriculum. These are my notes, grouped by what each stretch actually teaches. No passwords here — that's the point of the game — just the techniques.

Getting in

Every level is an SSH session on the same host, different user:

ssh bandit0@bandit.labs.overthewire.org -p 2220

That alone is a useful habit: non-standard port, per-level credentials, and a banner you learn to skim.

Reading files the box doesn't want you to read

The early levels are a crash course in quoting and paths. The password sits in a file, but the filename fights you:

A file literally named - — cat reads it as a flag, so you need a path:
```
cat ./-
```
Filenames with spaces — quote them or escape them:
```
cat "spaces in this filename"
```
Hidden files (ls -a), and files with non-printable / weird names that you tab-complete or reference with ./.

Takeaway: ls -la, quoting, and ./ in front of hostile filenames become muscle memory fast.

Finding the needle

Then it stops handing you the file and makes you find it. This is where the real toolkit shows up:

# by size, owner, and permissions
find / -type f -size 1033c -user bandit7 -group bandit6 2>/dev/null

# the one human-readable line among binaries
file ./*            # identify types first
strings data.txt    # pull printable text out of a binary blob

# the line that appears exactly once
sort data.txt | uniq -u

# the only line matching a marker
grep "millionth" data.txt

find with -size, -user, -perm, and 2>/dev/null to silence permission noise is probably the single most reused pattern in the whole game.

Decoding and transforming data

A run of levels is pure data-mangling — the password is there, just encoded:

base64 -d data.txt          # base64
tr 'A-Za-z' 'N-ZA-Mn-za-m'  # rot13
xxd -r data.txt             # hex -> bytes
# and repeatedly un-gzip / un-bzip2 / un-tar a file that's been
# compressed a dozen times, using `file` each round to see what's next

The compression-onion level is tedious but drills file, mv (to give it the right extension), and the decompress tools until they're automatic.

SSH keys, not just passwords

At some point the "password" is an RSA private key. You learn to save it, fix its permissions, and connect with it:

chmod 600 key.txt
ssh -i key.txt bandit14@localhost -p 2220

Talking to services

The networking levels are my favourite — you stop reading files and start speaking protocols:

nc localhost 30000                     # raw TCP, submit a password back to a port
openssl s_client -connect localhost:30001   # same, but over TLS
nmap -p 31000-32000 localhost          # find which port is even listening

Realising a "password prompt" is just a socket you can nc into is a nice click moment.

Scheduled jobs and writable scripts

The later levels lean into privilege via misconfiguration — the flavour of thing that matters for real security work:

A cron job runs as the next user and executes a script you can influence — read /etc/cron.d/, follow the script, drop your payload where it reads from.
A setuid binary or a script with loose permissions lets you run something as a user you're not.

The git levels

The final stretch is a small git course:

git clone ssh://bandit@localhost:2220/…   # clone the repo they give you
git log -p                                 # secrets hide in history
git show <commit>
git branch -a && git checkout <branch>
git tag && git show <tag>
git stash list && git stash show -p

Passwords get committed, reverted, tucked into branches, tags, and stashes — a genuinely good lesson in why git log is the first place to look.

What I took from it

Comfort in the shell is a force multiplier — most of security tooling assumes it.
find, grep, sort | uniq, and file do an enormous amount of work.
"Auth" is often just a socket, a file permission, or a git commit away.

A research log, not a résumé. In progress, on purpose.

Bandit is the only OverTheWire game I've worked through so far — notes on whatever I take on next will land here as I go.

OverTheWire: Bandit — finishing the Linux wargame