Bandit Level 24 → 25

Goal

Submit the current password plus every four-digit PIN to localhost port 30002 without reconnecting for each attempt.

Why this matters

Bounded enumeration shows how protocol constraints and connection overhead shape automation.

Progressive hints

1. Hint 1

   The candidate space is exactly 0000 through 9999.

2. Hint 2

   Preserve leading zeroes.

3. Hint 3

   Generate all lines and send them through one connection.

Method

Run only the lines that match the evidence you observe.

for pin in $(seq -w 0000 9999); do printf '%s %s\n' '<current-password>' "$pin"; done | nc localhost 30002

Expected non-secret observation

Most responses reject a PIN; one response includes the next credential without 10,000 separate connections.

Explanation

seq -w preserves width, and the pipeline streams the complete candidate set through one TCP session.

Troubleshooting

• Use the exact delimiter expected by the service.
• Enter the real current credential only in the game shell.
• Keep this enumeration strictly within the official localhost challenge.

Safety and cleanup

• Use only the OverTheWire game host and your own local practice directory.
• Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
• Treat commands as learning prompts: inspect paths and flags before running them.

Completion and next step

Use the recovered credential only in the official Level 25 login. Then mark this transition complete and continue.