The password lives inside a hidden file (its name starts with a dot) inside the inhere directory. Plain ls hides dotfiles — ls -a reveals them.

  • Platform: OverTheWire Bandit
  • Category: Linux Fundamentals
  • Level: 3 → 4
  • Difficulty: Beginner
  • Technique: Hidden files (dotfiles)

Challenge description

Level 3's home directory contains a subdirectory called inhere. Opening it and listing its contents with a plain ls shows... nothing. That's the trick.

"Level Goal: The password for the next level is stored in a hidden file in the inhere directory."

Step 1 — Enter the inhere directory

Log in as bandit3 and move into the subdirectory the level points to:

cd inhere ls 
(empty output)

Step 2 — List hidden files too

By convention, any file whose name starts with a dot (.) is hidden from a plain ls — the -a flag shows everything, dotfiles included:

ls -a 
. .. .hidden

Step 3 — Read the hidden file

There it is — a file called .hidden. Read it directly:

cat .hidden 
[PASSWORD FOR bandit4]

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Unix hides nothing from you — it just doesn't show dotfiles by default to keep directory listings clean. ls -a (or ls -la for the long format with permissions) is the reflex to build for any level, or any real system, where something seems to be missing.

  • A leading dot in a filename makes it hidden from plain ls, nothing more special than that
  • ls -a lists every entry, including . and ..
  • ls -la combines that with the long format (permissions, size, owner)

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.