OverTheWire Bandit Level 2 Writeup — Read a Filename With Spaces

Misc 2026-09-24 · OverTheWire Bandit · By

CTFdojo · ⏱ ... · 👁 ... views

TL;DR

The password file is named spaces in this filename. The shell splits unquoted arguments on whitespace, so the filename has to be quoted or escaped to be treated as one argument.

Platform	OverTheWire Bandit
Category	Linux Fundamentals
Level	2 → 3
Difficulty	Beginner
Technique	Shell quoting and escaping

Challenge description

Level 2's home directory has one file, but its name contains spaces. In a shell, unquoted spaces separate arguments — so typing the filename as-is splits it into several nonsense arguments instead of one filename.

"Level Goal: The password for the next level is stored in a file called spaces in this filename located in the home directory."

Step 1 — List the home directory

ls

spaces in this filename

Step 2 — Quote the filename

Wrap the whole name in double quotes so the shell treats it as a single argument:

cat "spaces in this filename"

[PASSWORD FOR bandit3]

Step 3 — The escaped alternative

Backslash-escaping each space works identically, and is what shell tab-completion generates automatically:

cat spaces\ in\ this\ filename

[PASSWORD FOR bandit3]

🔑 password intentionally hidden

The password is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

Whenever a filename might contain spaces (or other shell-special characters), quote it or escape it — and when in doubt, let tab-completion do it for you instead of typing it by hand.

Unquoted spaces in the shell separate arguments, they don't stay part of one filename
Double quotes ("...") or single quotes ('...') both keep a filename intact
Tab-completion after typing a few letters auto-escapes special characters for you

Resources

Got a question or a different approach?

Discuss this writeup with the community on the CTFdojo Discord.

Join the Discord →