Challenge description

Level 1's home directory contains exactly one file, and its name is a single dash: -. That's not a display glitch — it's the actual filename, chosen specifically to trip up the obvious command.

Step 1 — List the home directory

Log in as bandit1 with the password from level 0, then list the directory:

ls

-

Step 2 — The naive attempt fails

Reading it the obvious way doesn't do what you'd expect:

cat -

# hangs — it's now waiting for you to type something on stdin,
# because many Unix tools treat a bare - as "read from standard input"

Step 3 — Reference the file explicitly

Prefix the filename with ./ so the shell passes an unambiguous path instead of a bare dash:

cat ./-

[PASSWORD FOR bandit2]

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

A leading - in a filename is ambiguous to almost every command-line tool, since - is a long-standing Unix convention for "use stdin/stdout instead of a file." Prefixing a path (./) or using -- to mark the end of options both sidestep the ambiguity.

• A bare - as an argument commonly means stdin/stdout, not a literal filename
• ./filename forces the shell to treat it as a path, never as an option
• -- filename is the equivalent fix for tools that support the -- end-of-options marker

Resources

• OverTheWire Bandit
• GNU Coding Standards — Command-Line Interfaces

Related reading

Misc 2026-09-24

OverTheWire Bandit Level 2 Writeup — Read a Filename With Spaces

A password file with spaces in its name trips up anyone who doesn't quote or escape it properly in the shell.