tutorial · bandit

Bandit Level 2 → 3

Handle a filename containing spaces without splitting it into arguments.

By

banditshellquoting
Optional narration
Marks this level complete in your browser.

Goal

Read the password from the home-directory file whose name contains spaces.

Why this matters

Shell quoting is essential whenever paths contain whitespace or metacharacters.

Progressive hints

  1. Hint 1

    Let ls show the exact name.

  2. Hint 2

    Quotes preserve spaces as part of one argument.

  3. Hint 3

    Tab completion can safely complete the path too.

Method

Run only the lines that match the evidence you observe.

ls -la
cat "spaces in this filename"

Expected non-secret observation

The quoted path is treated as one filename and produces a single credential-like line.

Explanation

The shell removes the quote characters after using them to group the text into one argument.

Troubleshooting

  • Use Tab completion instead of retyping an uncertain name.
  • Check for doubled or missing spaces with printf '%q\n' * if needed.

Safety and cleanup

  • Use only the OverTheWire game host and your own local practice directory.
  • Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
  • Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 3 login. Then mark this transition complete and continue.