Linux Wargame: 20 Levels
You've met the tools one lesson at a time. This is where they come together. To the right is a 20-level wargame in the style of OverTheWire's Bandit, the classic first wargame almost every security person cuts their teeth on.
How it works
Every level hides the password to the next level somewhere in a small filesystem. Your job is to dig it out with a Linux command, then type:
next <the-password-you-found>
...to climb one rung. That's the whole loop: look around, find the password, advance. Your progress saves automatically in your browser, so you can leave and come back.
Three commands are always available:
goal, what this level wants from you.hint, a nudge. Stuck completely?hint -sreveals the full solution, but try first.levels, your progress so far.
Everything runs inside your browser. No real machine, no network, nothing you can break.
What each stretch teaches
The 20 levels are laid out to build on each other, exactly the skills from this week, in anger:
| Levels | What you practise |
|---|---|
| 0,3 | ls and cat; awkward names, a file called -, spaces, hidden dot-files |
| 4,6 | file to tell text from binary; find by size, owner and group |
| 7,9 | grep in a haystack; sort | uniq -u; strings to pull text from binary |
| 10,12 | Decoding by hand: base64, ROT13 with tr, hex dumps with xxd |
| 13,16 | The network toolkit: SSH keys, nc, TLS with openssl, nmap |
| 17,19 | diff, running a command over SSH without a shell, and setuid binaries |
Don't rush to hint -s. The whole point of a wargame is the small click of figuring it out, that's the muscle every later phase (recon, enumeration, privilege escalation) is built on.
A worked example (level 0)
You land on level 0 and read the goal: the password is in a file called readme.
level0@wargame$ ls
readme
level0@wargame$ cat readme
The password for level 1 is:
Xr7...(32 characters)...
level0@wargame$ next Xr7...(32 characters)...
Correct! Advancing…
That's it. Now do it 19 more times, each one teaching a new trick.
Why this matters
Reading a lesson about grep is one thing; needing grep to get unstuck is how it actually sticks. A wargame turns passive knowledge into reflexes, and these are the exact reflexes you'll reach for the moment you land on a real target box in the phases ahead. Climb all 20 and the Linux shell stops being a place you visit and starts being a place you live.