tutorial track
OverTheWire: Bandit
Levels, notes, and (later) pre-generated narration using your voice clone.
Progress
0/34 complete
Stored locally in your browser (no account required).
0%
Bandit Track: Overview
How this tutorial track works (and how to use the narration).
Bandit Level 0
SSH in, look around, and find the password for Level 1.
Bandit Level 1
Read a file literally named '-' (dash) and get the Level 2 password.
Bandit Level 2
Handle spaces in filenames safely (quotes and escaping).
Bandit Level 3
Find hidden files (dotfiles) and read the right one.
Bandit Level 4
Pick the only human-readable file from a directory of weird files.
Bandit Level 5
Find a file by size/type in a nested directory using find.
Bandit Level 6
Use find with multiple constraints (size, readable, not executable).
Bandit Level 7
Search the whole server with find (owner/group/size), then use grep to reduce noise.
Bandit Level 8
Use grep to find the line near the word 'millionth'.
Bandit Level 9
Find the only line that occurs once (sort + uniq).
Bandit Level 10
Use strings to extract readable text, then grep for the password marker.
Bandit Level 11
Decode base64 data to reveal the next password.
Bandit Level 12
Reverse ROT13 using tr to rotate letters back.
Bandit Level 13
Rebuild a repeatedly-compressed file from a hexdump (xxd + file + decompress loop).
Bandit Level 14
Use an SSH private key to log in as the next user (instead of a password).
Bandit Level 15
Send the current password to localhost:30000 using netcat.
Bandit Level 16
Submit the current password to localhost:30001 using TLS (openssl s_client).
Bandit Level 17
Scan localhost ports 31000–32000, find the TLS service that returns credentials.
Bandit Level 18
Use diff to extract the one changed line between passwords.old and passwords.new.
Bandit Level 19
Bypass an auto-logout .bashrc by running a command non-interactively over SSH.
Bandit Level 20
Use a setuid helper binary to read the next password from /etc/bandit_pass.
Bandit Level 21
Use a setuid connector binary + a local listener to receive the next password.
Bandit Level 22
Read /etc/cron.d, inspect the job script, and find where it writes the next password.
Bandit Level 23
Follow the cron job logic: it computes a filename, writes the password there.
Bandit Level 24
Write your first cron-triggered shell script and exfiltrate the next password to /tmp.
Bandit Level 25
Brute-force a 4-digit PIN over a single connection (no reconnect loop).
Bandit Level 26
Escape a non-bash shell (more/vi style) to get a real shell.
Bandit Level 27
With a real shell, read the next password.
Bandit Level 28
Clone a remote git repo over SSH (from your local machine) and find the password in the repo.
Bandit Level 29
Git repo: inspect commits/branches to find the hidden password.
Bandit Level 30
Git repo: check tags/remotes/hidden refs for the password.
Bandit Level 31
Git repo: you may need to modify files and push/commit per instructions.
Bandit Level 32
Git repo: follow instructions (often involves branching or a special commit).
Bandit Level 33
Another shell escape challenge — use the available shell/man tools to break out.