OverTheWire

What is OverTheWire?

OverTheWire is a collection of free, community-built wargames for learning security by doing. Instead of videos or theory, you connect to real servers over SSH (or through the browser, in the case of Natas) and work through levels: each level hides the password for the next one, and your job is to find it using the command line, reasoning and, gradually, exploitation techniques. It is one of the most recommended starting points for ethical hacking, and there is no sign-up or payment.

What OverTheWire is used for

• Mastering Linux and the terminal: Bandit makes you use ls, find, grep, sort, ssh, permissions and pipes until they become second nature.
• Preparing for CTFs and certifications: the console fluency pays off later on platforms such as HackTheBox or in hands-on exams like the eJPT.
• Learning web security with Natas, and binary exploitation, classical cryptography or privilege escalation with the other games.
• Practising at your own pace: the servers are always up and you can return to any level as long as you keep your passwords.

Getting started with Bandit

Bandit is the first game and the one to do before any other. All you need is an SSH client (built into Linux, macOS and Windows 10/11). For level 0 you connect like this:

ssh bandit0@bandit.labs.overthewire.org -p 2220

Note the port 2220: forgetting it is the most common beginner mistake. The level 0 password is given on the level page itself on overthewire.org. From there, each password you find lets you log in as the next user (bandit1, bandit2…). Always read the level page: it tells you where the password is and suggests useful commands.

Hints for Bandit levels 0 to 10 (no spoilers)

These hints point you in the right direction without giving away the answer. If you get stuck, try man command first.

1. 0 → 1: the password is in a file in the home directory. Just list and read.
2. 1 → 2: the file is called -. Many programs treat a dash as standard input; think about relative paths like ./.
3. 2 → 3: the filename contains spaces. Quotes or the Tab key are your friends.
4. 3 → 4: the file is hidden inside a directory. Which ls option shows files starting with a dot?
5. 4 → 5: only one of the files is human-readable. The file command tells you what each one contains.
6. 5 → 6: there are many directories; the file meets conditions on size, readability and not being executable. Combine find options.
7. 6 → 7: the file is somewhere on the server with a specific owner, group and size. Search from / and discard permission errors.
8. 7 → 8: the password sits next to a specific word in a huge file: grep.
9. 8 → 9: it is the only line that appears exactly once. sort and uniq work great together.
10. 9 → 10: the file is mostly binary; extract the readable strings and look for those preceded by several = characters.
11. 10 → 11: the data is encoded in a very common format for transporting text. Check base64 --help.

Example commands you will find useful (generic, not the exact solutions):

ls -la
file ./*
find . -type f -size 1033c ! -executable
find / -user someone -group somegroup -size 33c 2>/dev/null
sort data.txt | uniq -u
strings data.txt | grep "=="
base64 -d data.txt

Beyond Bandit: Natas, Leviathan, Krypton and more

• Natas: web security from the browser. Each level is a website (for example http://natas0.natas.labs.overthewire.org) with flaws such as file inclusion, command injection, SQLi or tamperable cookies. Pairs perfectly with Burp Suite.
• Leviathan: few levels, no hints, focused on SUID binaries and understanding what a program does with ltrace or strings.
• Krypton: classical cryptography (substitution ciphers, Vigenère and similar).
• Narnia, Behemoth, Utumno, Maze: binary exploitation (buffer overflows, format strings). They require some C and assembly.

Pro tips

• Keep passwords in a local notes file: the levels do not save progress.
• Write down which command solved each level and why. That notebook is worth more than the password.
• Do not reach for published solutions straight away. Spending 20 minutes with man find is exactly the learning.

Pros and cons

Pros	Cons
Completely free, no account needed	No theory: you have to research
Real environments, nothing to install	Bare interface, no progress tracking
Very well-graded progression	Advanced games have a steep curve

OverTheWire alternatives

• TryHackMe: more guided, with explanations and in-browser machines.
• Root-Me: hundreds of challenges by category, also free.
• HackTheBox: full machines once you are comfortable in the terminal.
• CryptoHack: if Krypton gets you hooked on cryptography.

Frequently asked questions

Is OverTheWire free?

Yes, all wargames are free and require no account. You only need an SSH client or a browser.

How do I connect to Bandit?

With ssh bandit0@bandit.labs.overthewire.org -p 2220 and the password shown on the level 0 page. For later levels, change the user to bandit1, bandit2, and so on.

Is playing OverTheWire legal?

Yes. The servers are designed to be attacked within the rules of the game. What you must not do is attack the infrastructure or other users.

If after Bandit you want to keep practising with guided terminal exercises, challenges and progress tracking, take a look at the Hackers en Acción Academy.