OverTheWire Bandit Level 1 Writeup — Read a File Named -

The password file is named - (a single dash). Running cat - reads from the keyboard instead, because - is a special argument to many programs — prefix it with ./ to force a literal filename.

• Platform: OverTheWire Bandit
• Category: Linux Fundamentals
• Level: 1 → 2
• Difficulty: Beginner
• Technique: Shell filename edge cases

Challenge description

Level 1's home directory contains exactly one file, and its name is a single dash: -. That's not a display glitch — it's the actual filename, chosen specifically to trip up the obvious command.

"Level Goal: The password for the next level is stored in a file called - located in the home directory."

Step 1 — List the home directory

Log in as bandit1 with the password from level 0, then list the directory:

ls

-

Step 2 — The naive attempt fails

Reading it the obvious way doesn't do what you'd expect:

cat -

# hangs — it's now waiting for you to type something on stdin,
# because many Unix tools treat a bare - as "read from standard input"

Step 3 — Reference the file explicitly

Prefix the filename with ./ so the shell passes an unambiguous path instead of a bare dash:

cat ./-

[PASSWORD FOR bandit2]

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

A leading - in a filename is ambiguous to almost every command-line tool, since - is a long-standing Unix convention for "use stdin/stdout instead of a file." Prefixing a path (./) or using -- to mark the end of options both sidestep the ambiguity.

• A bare - as an argument commonly means stdin/stdout, not a literal filename
• ./filename forces the shell to treat it as a path, never as an option
• -- filename is the equivalent fix for tools that support the -- end-of-options marker

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.