Skip to main content

Settings

Color Mode

Theme Skin

Background

Appearance preferences are saved in this browser only.

Environment

Current Environment Production

Built with JEKYLL_ENV=production. Changes require deployment.

Theme & Build

Jekyll v3.10.0
Last BuildOct 17, 19:54

Page Info

Layout default
Collection none
Path overthewire/bandit/bandit18.md
URL /docs/wargames/bandit/bandit18/
Date 2026-04-07

Source Code

Set repository: USER/REPO in your _config.yml to enable source-code shortcuts.

Bandit18

Bandit Level 18 — compare two files with diff to find the single line that changed.

Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.

Level Goal

There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new

NOTE: if you have solved this level and see ‘Byebye!’ when trying to log into bandit18, this is related to the next level, bandit19

Commands you may need to solve this level

cat, grep, ls, diff

Study guide

Level map: logged in as bandit17, find the password for bandit18.

What this level teaches

How to find differences between two versions of a file, and how to read a diff.

Key ideas

  • diff old new prints only the lines that differ. A < marks a line from the first file and > a line from the second.
  • Why it matters for text. Version control, patches and configuration audits all rely on exactly this idea.
  • A hint in the Level Goal: only one line changed, so the output should be tiny.

How to approach it

  1. Read man diff, paying attention to the default output format.
  2. Decide which of the two lines is the password, using the file names in the Level Goal.
  3. After you finish, log out and back in as the new user. If a message appears, it relates to the next level, so keep reading.

Why it matters

git diff, code review and configuration-drift tools are all diff under another name.