Goal
A service listening on one port in 31000–32000 will return the next credentials.
But first:
- Find which ports are open
- Identify which of those speak TLS
- Send your current password to the correct one
Hints
nmapis the fastest way to scan a port range.- Many ports may be open, but only one will actually give credentials.
- The wrong services might just echo back what you send.
Solution (click to reveal)
- SSH in:
ssh bandit17@bandit.labs.overthewire.org -p 2220
- Scan the range:
nmap -p 31000-32000 localhost
- For each open port, check if it’s TLS:
openssl s_client -connect localhost:<port>
If it’s not TLS, you’ll usually get garbage / handshake failure.
- When you find the TLS-speaking port that returns credentials, submit your current password (paste it after connecting).
The response will include the credentials for the next level.
Notes
- You can speed this up with nmap service detection:
nmap -sV -p 31000-32000 localhost
- Keep a scratch note of “open ports” vs “TLS ports” so you don’t loop.