Bandit 1 → 2: the file called -

This level is one file, and the file is named -. That’s it. The trick is that - isn’t really a filename as far as most command-line tools are concerned — they claimed that character for something else a long time ago. So the obvious command doesn’t fail loudly. It just quietly doesn’t do what you meant.

the goal

The password for the next level is stored in a file called - located in the home directory.

the approach

Look first, same as every level:

bandit1@bandit:~$ ls
-

I ran ls -f too, out of habit, in case something was hiding. Nothing was — the dash is the whole level.

Then the obvious move, which doesn’t work:

bandit1@bandit:~$ cat -

No error, no output, just a cursor sitting there. That’s not a bug: to cat, a bare - is a convention meaning “read from standard input”, not a file to open. So it was politely waiting for me to type the file at it. Ctrl+C to get out.

I had to look up how to read a file whose name starts with a dash. The fix is to stop it from looking like a bare dash — give it a path instead:

bandit1@bandit:~$ cat ./-

./ means “in the current directory”, so the argument is now ./-, which is a path. cat has no special meaning for that, so it just opens the file. Password printed. I’m not reprinting it here — OverTheWire asks people not to publish them, and doing the step yourself is most of the point.

the takeaway

A leading - gets read as a flag or a stdin marker, not as part of the name. Sticking ./ in front turns it back into an ordinary path, and that works for any file whose name starts with a dash.

Worth knowing what doesn’t rescue you here: --, the “no more options after this” separator. It works for things like rm -- -file because there the dash is being parsed as an option. But - meaning stdin isn’t an option, so cat -- - still sits there waiting on your keyboard. ./ is the one that actually solves this.