OverTheWire Bandit Level 3 Writeup — Find a Hidden Dotfile

The password lives inside a hidden file (its name starts with a dot) inside the inhere directory. Plain ls hides dotfiles — ls -a reveals them.

• Platform: OverTheWire Bandit
• Category: Linux Fundamentals
• Level: 3 → 4
• Difficulty: Beginner
• Technique: Hidden files (dotfiles)

Challenge description

Level 3's home directory contains a subdirectory called inhere. Opening it and listing its contents with a plain ls shows... nothing. That's the trick.

"Level Goal: The password for the next level is stored in a hidden file in the inhere directory."

Step 1 — Enter the inhere directory

Log in as bandit3 and move into the subdirectory the level points to:

cd inhere ls 

(empty output) 

Step 2 — List hidden files too

By convention, any file whose name starts with a dot (.) is hidden from a plain ls — the -a flag shows everything, dotfiles included:

ls -a 

. .. .hidden 

Step 3 — Read the hidden file

There it is — a file called .hidden. Read it directly:

cat .hidden 

[PASSWORD FOR bandit4] 

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Unix hides nothing from you — it just doesn't show dotfiles by default to keep directory listings clean. ls -a (or ls -la for the long format with permissions) is the reflex to build for any level, or any real system, where something seems to be missing.

• A leading dot in a filename makes it hidden from plain ls, nothing more special than that
• ls -a lists every entry, including . and ..
• ls -la combines that with the long format (permissions, size, owner)

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.