Goal
Clone the bandit30-git repository and find the password referenced by a tag.
Why this matters
Tags are durable named refs that can expose releases, historical states, or embedded data outside the working tree.
Progressive hints
Hint 1
List all tags after cloning.
Hint 2
Show the interesting tag directly.
Hint 3
A tag may reference a commit or another Git object.
Method
Run only the lines that match the evidence you observe.
git clone <official-bandit30-repository-url>
cd repo && git tag --list
git show <tag-name>Expected non-secret observation
Showing the tag reveals the next credential even though it is not visible in the default files.
Explanation
A tag is a ref; git show resolves it and displays the referenced object and metadata.
Troubleshooting
- Fetch tags explicitly with git fetch --tags if the list is empty.
- Use git cat-file -t <tag> to identify an unfamiliar object type.
Safety and cleanup
- Use only the OverTheWire game host and your own local practice directory.
- Do not paste a level password into this site, screenshots, notes, or submissions. Baitaphish never asks for credentials.
- Treat commands as learning prompts: inspect paths and flags before running them.
Completion and next step
Use the recovered credential only in the official Level 31 login. Then mark this transition complete and continue.