OverTheWire Bandit Walk-through for Beginners: Level 0 to Level 12

For anyone building a foundation in cybersecurity, comfort with the Linux command line is non-negotiable. OverTheWire's Bandit wargame is widely recommended as a starting point. Because each level of this CTF introduces one core concept, building progressively toward more advanced skills.

This post documents my progress through Level 0 to 11, with an short explanation behind each command rather than just the command themselves.

Level 0: Connecting to the server

Every level Begins with logging in via SSH. Bandit runs its SSH service on a non-standard port, which means the connection command has to specify it explicitly.

ssh [email protected] -p 2200

It's a minor point, but useful early reminder that not every service runs on its default port.

Enter bandit0 for the password!

Level 0 → Level 1

The password for next level was stored in a file named readme in home directory. Use ls to confirm the file's presence, followed by cat to read its content.Very simple, but this pairing the basis of nearly everything that follows!

Level 1 → Level 2

This level introduced a small but important obstacle. The target file was name '-'.

We can't use cat command to read this file, because the shell thinks '-' as an option flag rather than a filename. So, the command doesn't work as intended.

The solution is simple. We can tells the shell to treat it as a file in the current directory using './' before the filename(-).

Level 2 → Level 3

In this level things get bit tricky. The password file in here was named --spaces in this filename with actual spaces in the name and starting with '-'.

By default, the shell treats each space as a separator between arguments, which cause it to misread this as several distinct filenames. To fix this we have two options here.

1. Escape each space with a backslash(). This tells the shell to treat spaces as literal character.

2. Using " " to cover the filename. This also tells the shell to Treat spaces as literal characters rather than delimiters.

I used the second method, because it's very clean. But in here we have another problem. Filename starts with '-', and it leads the shell to think this is an option flag. So we have to use the previous method to pass it.

cat "./--spaces in this filename--"

Level 3 → Level 4

In here we have a directory, which is named inhere. We can change the directory using cd command.

cd inhere

But in this directory, there is no files we can see.

File is located in here, but it is hidden from us!
To see all the files in a directory, including hidden files, we can use ls -la command. Then you can read the file using cat command.

Level 4 → Level 5

The inhere directory in this level contained several files. But only one file is human-readable. Rather than inspecting each file manually, I used file ./*.

The file command examines a file's actual content to determine its type, independent of its name or extension. One file was identified as ASCII text, which turned out to be the target.

One habit worth building early:
Whenever you're unsure what a command does or which flags are available, run it with --help (Ex:- find --help, cd --help). Most core Linux utilities support this flag, and it's often faster and more reliable than searching online. You can also use man command to get help (Ex:- man find).

Level 5 → Level 6

This level is little bit harder than previous ones. Because this level provided no filename or directory. It only provided a set of properties.

• human-readable
• exactly 1033 bytes
• not executable

I used findcommand to find files which fulfill these properties.

find ./ -type f -size 1033c ! -executable

After this I used the cat command to read the file.

Theory

• '-type f' restricts results to regular files.
• '-size 1033c' matches files of exactly 1033 bytes. c stands for bytes.
• '! -executable' negates the executable condition.

Level 6 → Level 7

Also this level follows the similar logic of the previous level. I used -user and -group flags for filter the file.

find ./ -type f -size 33c -user bandit7 -group bandit6

But if you pass a command like this, it gives you bunch of "Permission denied" results. It is called spamming stderr.

I used 2</dev/null to move error files to the dev/null file. So I can see results which are not given an error.

Level 7 → Level 8

This level marked a meaningful step up in complexity. The data.txt file contained a large volume of text, with the password located next to the word "millionth". Manually searching through this file for the password is not practical. So I used:

sort data.txt | grep millionth

This was my first use of the pipe(|).
It passes the output of one command directly into another.
sort orders the file's content and grep millionth filters the result down to the relevant line.

Level 8 → Level 9

This is tricky one. Because the object here was to find the single line in data.txt that appeared exactly once. I already know that i need to use uniq command. But here's the thing, uniq only identifies duplicate lines only when they are adjacent. So you have to sort the data first.

sort data.txt | uniq -u

-u flag isolates lines that accur exactly once.

Level 9 → Level 10

In here data.txt consisted largely of binary content, with the password appearing as one of a small number of readable strings, marked by a series of "=" characters.
So, I used string command to extracts readable text from the file. It disregarding non-printable binary data. Piping this into grep = given me the result that i am looking for.

Level 10 → Level 11

The password for the next level is stored in the file data.txt, which contains base64 encoded data. So this is the next hard level I faced as a beginner for this.

I quickly searched on the google and found that there is a command named base64, and i have to enter the command with -d flag to decode the encoded data.

cat data.txt | base64 -d

Base64 coding appears frequently across security-related contexts, from web traffic to malware analysis.

Level 11 → Level 12

This is also a hard one for me as a beginner!!
Flag is stored in the file data.txt, where all lowercase(a-z) and uppercase(A-Z) letters have been rotated by 13 positions. It is called Rot13.

Quick google search helped me to find that you need to use tr command to reverse the rotation process.

Quick Summary

In this post, I worked through Level 0 → 12 of OverTheWire's Bandit wargame, covering some foundational Linux skills: connecting via SSH, reading and locating files, handling unusual filenames, searching by file properties, usage of find, and chaining commands with pipes to filter, sort, and decode data. Each level builds from basic navigation to problem-solving on the command line.

I'm still early in my own cybersecurity journey, so this series is as much about documenting my learning as it is about helping others starting out. If you're also new I'd like to hear where you're at.Feel free to share your thoughts and which level gave you the most trouble. Level 12+ coming soon, so follow along if you like to learn alongside me!