DEV Community: Lakindu Mansara

OverTheWire Bandit Level 13 to Level 15 Walk-through

Lakindu Mansara — Tue, 14 Jul 2026 11:12:11 +0000

Introduction

In this part of my OverTheWire Bandit journey, I solved Level 13 and Level 14. These levels introduced two important cybersecurity concepts:

Using SSH keys for authentication
Connecting to services using network tools

Bandit Level 13 → Level 14

Objective

The password for the next level is stored in a file called sshkey.private.

Unlike previous levels, this time we are not given a password. Instead, we receive a private SSH key that can be used to log into the next account.

Step 1: Check the Files

After connecting to the Bandit server, always check files in your current directory. It always help a lot to me.

Interesting!
In here, we have a file, named sshkey.private.
To see the content of that file, I used the cat command.

Step 2: Copy the File

As the result showed, it is a private SSH key. Then i logout from the bandit server and used scp command to copy the ssh key file to my local machine.

scp -P 2220 bandit13@bandit.labs.overthewire.org:~/sshkey.private .

-P = Used to mention the port
bandit13@bandit.labs.overthewire.org = [user]@[host]
~/sshkey.private = Used to mention the location of the file I want to copy
. = Used to copy that file to my current directory

Then enter the password, which is you owned from the previous level.

Theory

scp stands for "Secure Copy Protocol". In Linux it is a command-line utility used to securely copy files and directories between different hosts over a network. Use man scp command for more details.

Successfully copied!

Step 3: Login to the Next Level

I used ssh -i command for this. Since I have the SSH private key. I tried to login to the bandit14 host server using it.

ssh -i ~/sshkey.private bandit14@bandit.labs.overthewire.org -p 2220

-i = Identity file path
~/sshkey.private = File path
bandit14@bandit.labs.overthewire.org = [user]@[Host]

Unexpected error!

Sometimes things do not work the way we think they will. A command that seems correct may give an unexpected error, and that is part of the learning process.

It says the private key is unprotected. So, I channge the file mode using chmod command.

chmod 600 ~/sshkey.private

I used the 600 for the numeric number, also you can use 400 for this I guess!

Theory

After changing the mode of my file, I retried to login.

Mission successful!

Bandit Level 14 → Level 15

Objective

The password for Bandit Level 15 is obtained by connecting to a service

running on: local host
on port: 30000

Step 1: Get the Password of the Previous Level

As always I checked for any files.
Next I directly read the password using cat command and the location which is mentioned in the previous level.

cat /etc/bandit_pass/bandit14

Step 2: Connect to the Service

At this level, I needed to connect to a service that running on port 30000 and send the current password to it. I needed a tool that could create a direct connection to a specific port, and this is where Netcat (nc) became useful. Netcat allows us to communicate with network services by opening a TCP connection.

A normal command like ssh is not suitable because we are not trying to log into another account. We are simply sending data to a service.

nc bandit.labs.overthewire.org 30000

nc = Netcat
bandit.labs.overthewire.org = Host
30000 = Port

Step 3: Send the current password

After pressing Enter there is only blank.
In that blank you have to enter the password we found and then press the Enter.

Congratulations!
You Found the flag and completed the level with lots of new knowledge.

Conclusion

Completing these levels helped me understand more about SSH authentication, private keys, and network communication using Netcat. More importantly, I learned that cybersecurity is not only about finding the correct answer — it is about exploring, making mistakes, troubleshooting, and improving step by step.

I am still a beginner in cybersecurity, and this blog is a place where I document my learning journey. I am sharing what I learn, the challenges I face, and the knowledge I gain along the way. Every level is a small step toward becoming better.

"I have no special talents. I am only passionately curious."

Albert Einstein -

Curiosity is what keeps me learning, experimenting, and continuing this journey.

OverTheWire Bandit Level 12 to Level 13: From Hex Dump to Password!

Lakindu Mansara — Mon, 13 Jul 2026 10:42:29 +0000

Welcome back to my OverTheWire Bandit series! In the previous article, we solved Bandit Level 0 → Level 12, where we learned lots of techniques in Linux.

In this article, we'll tackle Bandit Level 12 → Level 13, one of the most engaging levels in the Bandit wargame. This challenge introduces us to hex dumps, file identification, and extracting data from multiple layers of compressed archives using essential Linux command-line tools. Instead of relying on guesses, we'll learn how to analyze files methodically and uncover the password step by step.

A little note before we begin: I am also a beginner who is learning Linux and cybersecurity step by step. This walk-through is based on my own learning experience while solving the OverTheWire Bandit challenges.

I am documenting my journey to help other beginners who are starting from the same point. If you are also new to Linux, command-line tools, or cybersecurity, I hope my explanations make these challenges easier to understand.

Let's learn and improve together!

First things first, login to the bandit server using:

ssh bandit12@bandit.labs.overthewire.org -p 2220

and previous level flag as the password.

Step 1: List the Files

After logging in to the Bandit server, I always start by listing the files in the current directory using ls command. This simple habit helps me understand what files are available and where I should begin.

In here, there is a single file named data.txt. This file contains the challenge data that we'll work with throughout this level. I tried to read the file using cat command.

As you can see, this file is a hex dump of another file.
This means we have to work with this file many times.

Step 2: Create a Temporary Directory

Since we will be modifying and extracting the file multiple times, it is better to work inside a temporary directory. Linux provides the mktemp command for creating temporary files and directories safely.

In this case I created a temporary directory using:

mktemp -d

and change current directory to that temporary directory.

cd {directory}

Step 3: Copy the Original File

I created a copy of the original file in this directory.

cp ~/data.txt .

In here the '.' means current directory. So, this means I created a copy of the data.txt file, which is located in root directory, into my current directory.

I changed the file name to "hexdump" for better view.

Step 4: Reversing the Hex Dump File

In this case, we have to use the xxd tool to reverse the hexdump file to its original form (Binary form).

xxd -r hexdump {new_name}

As you can see here, there is a new file and it is the original binary form of this file. But it is still compressed!

xxd - tool for creating and reading hex dumps.
-r - reverse the hex dump back into binary.

Step 5: Decompress the File (gzip)

Looking at the first line, we see that these are the first bytes of the file. Quick google search told me that this is a gzip compressed file.

For decompress this file We have to add the correct ending to the file. In here it is .gz. So, I renamed the file and decompress it using gzip -d command.

Step 6: Decompress the File Again (bzip2)

I read the new hex dump using xxd command.

After searching the first bytes on the google, shows that it is a bzip version 2 compressed file.

Again we have to change the file name with the correct ending to decompress this, in here it is .bz2. For decompressing I used bzip2 -d command.

Step 7: Decompress the File Again (gzip)

This is a tricky one. Because after check the file using xxd, it shows again this is a gzip compressed file.

Here's the thing. This file is compressed multiple times, not only once. So you have to rename and decompress using correct tool every time until you reach the end point.

Step 8: Extract the File

After decompress all the way to the end. I get an tar file.

Again I renamed the filename to the correct ending form, which is .tar and extract the file using tar -xf command. After extracting I listed the files using ls and found a new file called data5.bin.

Then again I read the hex dump using xxd command and found it is also a tar file. Rename again with .tar and used tar -xf command to extract it. After extracting, another file named data6.bin appeared.

Step 9: Decompress the New File (bzip2)

Then I read the hex dump of the new data6.bin file using xxd command and found that it is a bzip version 2 compressed file again.

Then I renamed the filename to data6.bz2 and decompressed it using bzip2 -d command.

Then I checked again the hex dump value of the decompressed file and it is a tar file again.

Step 10: Extract the File Again

Renamed the filename to data6.tar and extracted it using tar -xf command. It created a new file named data8.bin.

Step 11: Decompress the New File (gzip)

Again read the hex dumb of the new file and it was a gzip compressed file again. So, I repeated the same method I used before.

Step 12: Final Step

After decompressing, I read the hex dump of the file again and finally our file is fully decompressed to the end!

Use cat command to read the file!

Summary

In this level, we learned how to work with a file that was stored as a hex dump. We first created a temporary workspace, copied the file, and then converted the hex dump back into its original binary format using xxd -r.

After restoring the file, we used first 8 bytes of the hex dump to identify its type and extracted multiple layers of compressed data until we found the password for the next level.

This challenge helped us understand the importance of analyzing files step by step instead of guessing. We learned how Linux tools like xxd and different extraction commands can be used together for file analysis.

This is a walk-through by a real beginner, for beginners. I hope my learning process and explanations help you understand the challenges and improve your own skills. If you find any mistakes or have suggestions for improvement, please let me know. I am still learning, and your feedback helps me grow.

OverTheWire Bandit Walk-through for Beginners: Level 0 to Level 12

Lakindu Mansara — Mon, 13 Jul 2026 04:27:54 +0000

For anyone building a foundation in cybersecurity, comfort with the Linux command line is non-negotiable. OverTheWire's Bandit wargame is widely recommended as a starting point. Because each level of this CTF introduces one core concept, building progressively toward more advanced skills.

This post documents my progress through Level 0 to 11, with an short explanation behind each command rather than just the command themselves.

Level 0: Connecting to the server

Every level Begins with logging in via SSH. Bandit runs its SSH service on a non-standard port, which means the connection command has to specify it explicitly.

ssh bandit0@bandit.labs.overthwire.org -p 2200

It's a minor point, but useful early reminder that not every service runs on its default port.

Enter bandit0 for the password!

Level 0 → Level 1

The password for next level was stored in a file named readme in home directory. Use ls to confirm the file's presence, followed by cat to read its content.Very simple, but this pairing the basis of nearly everything that follows!

Level 1 → Level 2

This level introduced a small but important obstacle. The target file was name '-'.

We can't use cat command to read this file, because the shell thinks '-' as an option flag rather than a filename. So, the command doesn't work as intended.

The solution is simple. We can tells the shell to treat it as a file in the current directory using './' before the filename(-).

Level 2 → Level 3

In this level things get bit tricky. The password file in here was named --spaces in this filename with actual spaces in the name and starting with '-'.

By default, the shell treats each space as a separator between arguments, which cause it to misread this as several distinct filenames. To fix this we have two options here.

Escape each space with a backslash(). This tells the shell to treat spaces as literal character.
Using " " to cover the filename. This also tells the shell to Treat spaces as literal characters rather than delimiters.

I used the second method, because it's very clean. But in here we have another problem. Filename starts with '-', and it leads the shell to think this is an option flag. So we have to use the previous method to pass it.

cat "./--spaces in this filename--"

Level 3 → Level 4

In here we have a directory, which is named inhere. We can change the directory using cd command.

cd inhere

But in this directory, there is no files we can see.

File is located in here, but it is hidden from us!
To see all the files in a directory, including hidden files, we can use ls -la command. Then you can read the file using cat command.

Level 4 → Level 5

The inhere directory in this level contained several files. But only one file is human-readable. Rather than inspecting each file manually, I used file ./*.

The file command examines a file's actual content to determine its type, independent of its name or extension. One file was identified as ASCII text, which turned out to be the target.

One habit worth building early:
Whenever you're unsure what a command does or which flags are available, run it with --help (Ex:- find --help, cd --help). Most core Linux utilities support this flag, and it's often faster and more reliable than searching online. You can also use man command to get help (Ex:- man find).

Level 5 → Level 6

This level is little bit harder than previous ones. Because this level provided no filename or directory. It only provided a set of properties.

human-readable
exactly 1033 bytes
not executable

I used findcommand to find files which fulfill these properties.

find ./ -type f -size 1033c ! -executable

After this I used the cat command to read the file.

Theory

'-type f' restricts results to regular files.

'-size 1033c' matches files of exactly 1033 bytes. c stands for bytes.

'! -executable' negates the executable condition.

Level 6 → Level 7

Also this level follows the similar logic of the previous level. I used -user and -group flags for filter the file.

find ./ -type f -size 33c -user bandit7 -group bandit6

But if you pass a command like this, it gives you bunch of "Permission denied" results. It is called spamming stderr.

I used 2</dev/null to move error files to the dev/null file. So I can see results which are not given an error.

Level 7 → Level 8

This level marked a meaningful step up in complexity. The data.txt file contained a large volume of text, with the password located next to the word "millionth". Manually searching through this file for the password is not practical. So I used:

sort data.txt | grep millionth

This was my first use of the pipe(|).
It passes the output of one command directly into another.
sort orders the file's content and grep millionth filters the result down to the relevant line.

Level 8 → Level 9

This is tricky one. Because the object here was to find the single line in data.txt that appeared exactly once. I already know that i need to use uniq command. But here's the thing, uniq only identifies duplicate lines only when they are adjacent. So you have to sort the data first.

sort data.txt | uniq -u

-u flag isolates lines that accur exactly once.

Level 9 → Level 10

In here data.txt consisted largely of binary content, with the password appearing as one of a small number of readable strings, marked by a series of "=" characters.
So, I used string command to extracts readable text from the file. It disregarding non-printable binary data. Piping this into grep = given me the result that i am looking for.

Level 10 → Level 11

The password for the next level is stored in the file data.txt, which contains base64 encoded data. So this is the next hard level I faced as a beginner for this.

I quickly searched on the google and found that there is a command named base64, and i have to enter the command with -d flag to decode the encoded data.

cat data.txt | base64 -d

Base64 coding appears frequently across security-related contexts, from web traffic to malware analysis.

Level 11 → Level 12

This is also a hard one for me as a beginner!!
Flag is stored in the file data.txt, where all lowercase(a-z) and uppercase(A-Z) letters have been rotated by 13 positions. It is called Rot13.

Quick google search helped me to find that you need to use tr command to reverse the rotation process.

Quick Summary

In this post, I worked through Level 0 → 12 of OverTheWire's Bandit wargame, covering some foundational Linux skills: connecting via SSH, reading and locating files, handling unusual filenames, searching by file properties, usage of find, and chaining commands with pipes to filter, sort, and decode data. Each level builds from basic navigation to problem-solving on the command line.

I'm still early in my own cybersecurity journey, so this series is as much about documenting my learning as it is about helping others starting out. If you're also new I'd like to hear where you're at.Feel free to share your thoughts and which level gave you the most trouble. Level 12+ coming soon, so follow along if you like to learn alongside me!