data.txt holds the password encoded in base64 — the base64 command's -d flag decodes it directly back to plain text.

  • Platform: OverTheWire Bandit
  • Category: Linux Fundamentals
  • Level: 10 → 11
  • Difficulty: Beginner
  • Technique: base64 decoding

Challenge description

No searching or filtering this time — the file is small and its entire content is the password, just run through base64 encoding first.

"Level Goal: The password for the next level is stored in the file data.txt, which contains base64 encoded data."

Step 1 — Look at the raw content

Log in as bandit10 and view the file directly — it's short, and clearly made up only of base64's alphabet (letters, digits, +, /, and padding = characters):

cat data.txt 
VGhlIHBhc3N3b3JkIGlzIC4uLg==

Step 2 — Decode it

The base64 utility's -d (decode) flag reverses the encoding directly:

base64 -d data.txt 
[PASSWORD FOR bandit11]

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Base64 is encoding, not encryption — it has no secret key, so anything base64-encoded decodes with a single command the moment you recognize the alphabet. Spotting base64 by sight (that specific character set, often padded with one or two trailing = signs) is a skill worth having automatic by this point.

  • Base64 uses only A-Z, a-z, 0-9, +, /, and = padding — recognizable on sight once you've seen it a few times
  • base64 -d decodes; plain base64 (no flag) encodes
  • No password or key is involved — base64 is a reversible encoding, never a cipher

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.