Goal
Recover data.txt from a hexdump, then repeatedly decompress it until the password is revealed.
Why this matters
Artifact analysis often requires identifying each layer before applying the matching transformation.
Progressive hints
Hint 1
Work in a fresh directory under /tmp.
Hint 2
Reverse the hexdump first.
Hint 3
After every step, use file to identify the next format instead of guessing.
Method
Run only the lines that match the evidence you observe.
workdir=$(mktemp -d /tmp/bandit12.XXXXXX)
cp data.txt "$workdir/hexdump.txt" && cd "$workdir"
xxd -r hexdump.txt > layer
file layer
# Rename/copy layer for the format reported, decompress it, then run file again.Expected non-secret observation
Each operation changes the reported type; the last layer is readable text.
Explanation
xxd -r reconstructs bytes. gzip, bzip2, and tar solve different layers, so file supplies the evidence for each next action.
Troubleshooting
- Do not overwrite the only copy of the hexdump.
- A decompressor may depend on a conventional filename suffix; rename a working copy accordingly.
Safety and cleanup
- Use only the OverTheWire game host and your own local practice directory.
- Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
- Treat commands as learning prompts: inspect paths and flags before running them.
Completion and next step
Use the recovered credential only in the official Level 13 login. Then mark this transition complete and continue.