DEV Community

Cover image for OverTheWire Bandit Level 13 to Level 15 Walk-through
Lakindu Mansara
Lakindu Mansara

Posted on

OverTheWire Bandit Level 13 to Level 15 Walk-through

#cybersecurity #programming #learning #linux

Introduction

In this part of my OverTheWire Bandit journey, I solved Level 13 and Level 14. These levels introduced two important cybersecurity concepts:

  • Using SSH keys for authentication
  • Connecting to services using network tools

Bandit Level 13 → Level 14

Objective

The password for the next level is stored in a file called sshkey.private.

Unlike previous levels, this time we are not given a password. Instead, we receive a private SSH key that can be used to log into the next account.

Step 1: Check the Files

After connecting to the Bandit server, always check files in your current directory. It always help a lot to me.

Interesting!
In here, we have a file, named sshkey.private.
To see the content of that file, I used the cat command.

Step 2: Copy the File

As the result showed, it is a private SSH key. Then i logout from the bandit server and used scp command to copy the ssh key file to my local machine.

scp -P 2220 bandit13@bandit.labs.overthewire.org:~/sshkey.private .
Enter fullscreen mode Exit fullscreen mode
  • -P = Used to mention the port
  • bandit13@bandit.labs.overthewire.org = [user]@[host]
  • ~/sshkey.private = Used to mention the location of the file I want to copy
  • . = Used to copy that file to my current directory

Then enter the password, which is you owned from the previous level.

Theory

scp stands for "Secure Copy Protocol". In Linux it is a command-line utility used to securely copy files and directories between different hosts over a network. Use man scp command for more details.

Successfully copied!

Step 3: Login to the Next Level

I used ssh -i command for this. Since I have the SSH private key. I tried to login to the bandit14 host server using it.

ssh -i ~/sshkey.private bandit14@bandit.labs.overthewire.org -p 2220
Enter fullscreen mode Exit fullscreen mode
  • -i = Identity file path
  • ~/sshkey.private = File path
  • bandit14@bandit.labs.overthewire.org = [user]@[Host]

Unexpected error!

Sometimes things do not work the way we think they will. A command that seems correct may give an unexpected error, and that is part of the learning process.

It says the private key is unprotected. So, I channge the file mode using chmod command.

chmod 600 ~/sshkey.private
Enter fullscreen mode Exit fullscreen mode

I used the 600 for the numeric number, also you can use 400 for this I guess!

Theory

After changing the mode of my file, I retried to login.

Mission successful!

Bandit Level 14 → Level 15

Objective

The password for Bandit Level 15 is obtained by connecting to a service

  • running on: local host
  • on port: 30000

Step 1: Get the Password of the Previous Level

As always I checked for any files.
Next I directly read the password using cat command and the location which is mentioned in the previous level.

cat /etc/bandit_pass/bandit14
Enter fullscreen mode Exit fullscreen mode

Step 2: Connect to the Service

At this level, I needed to connect to a service that running on port 30000 and send the current password to it. I needed a tool that could create a direct connection to a specific port, and this is where Netcat (nc) became useful. Netcat allows us to communicate with network services by opening a TCP connection.

A normal command like ssh is not suitable because we are not trying to log into another account. We are simply sending data to a service.

nc bandit.labs.overthewire.org 30000
Enter fullscreen mode Exit fullscreen mode
  • nc = Netcat
  • bandit.labs.overthewire.org = Host
  • 30000 = Port

Step 3: Send the current password

After pressing Enter there is only blank.
In that blank you have to enter the password we found and then press the Enter.

Congratulations!
You Found the flag and completed the level with lots of new knowledge.

Conclusion

Completing these levels helped me understand more about SSH authentication, private keys, and network communication using Netcat. More importantly, I learned that cybersecurity is not only about finding the correct answer — it is about exploring, making mistakes, troubleshooting, and improving step by step.

I am still a beginner in cybersecurity, and this blog is a place where I document my learning journey. I am sharing what I learn, the challenges I face, and the knowledge I gain along the way. Every level is a small step toward becoming better.

"I have no special talents. I am only passionately curious."

  • Albert Einstein -

Curiosity is what keeps me learning, experimenting, and continuing this journey.

Top comments (0)