OverTheWire Bandit Walkthrough — Level 24 → 25 | 30-Day Cybersecurity Learning Journey (Day 24)

Brute forcing a 4-digit PIN using a bash loop and Netcat and why understanding how to automate credential testing is a core skill in both offensive and defensive security.

Introduction

Day 24. Bandit Level 24 to Level 25. There is a service running on port 30002 that will hand over the next password, but only if both the current password and a secret 4-digit PIN are submitted together on a single line. No hints are given about the PIN. There are 10000 possible combinations from 0000 to 9999 and the only way to find the right one is to try all of them. That is brute forcing.

This level introduces two important techniques working together. The first is using a bash loop to generate a wordlist of every possible input combination. The second is piping that entire wordlist through Netcat to submit all 10000 attempts in a single operation, then filtering the output with grep to surface only the successful result from the flood of failed ones.

By the end of this article you will know how to generate structured test input with seq and a for loop, how to pipe that input through a network service with Netcat and how to filter large output to find exactly the one line that matters.

Level Objective

A daemon is listening on port 30002 and will give you the password for bandit25 if given the password for bandit24 and a secret numeric 4-digit pincode. There is no way to retrieve the pincode except by going through all of the 10000 combinations, called brute-forcing.

Approach

I connected from my local Kali machine using the password retrieved from the previous level:

ssh bandit24@bandit.labs.overthewire.org -p 2220

The full Bandit ASCII art banner loaded and the prompt changed to bandit24@bandit:~$.

Logged into bandit24 via SSH on port 2220.

I ran ls -la and confirmed the home directory contained nothing useful. I created a dedicated working directory for this level:

mkdir -p /tmp/james24lab
cd /tmp/james24lab

The directory listing confirmed it was created and owned by bandit24. The next step was generating every possible combination of the current password paired with a 4-digit PIN. I used a for loop with seq -w to produce zero-padded PIN values from 0000 to 9999, writing all 10000 lines into a single file:

for i in $(seq -w 0000 9999); do
  echo "gb8KRRCsshuZXI0tUuR6yp............... $i"
done > /tmp/james24lab/guesses.txt

I verified the file with wc -l and a preview using head:

wc -l /tmp/james24lab/guesses.txt
head /tmp/james24lab/guesses.txt

The output confirmed exactly 10000 lines. The first few showed the correct format: the password followed by a space and the zero-padded PIN. With the wordlist ready, I submitted the entire file to port 30002 through Netcat and piped the output into grep -v "Wrong" to filter out every failed attempt and show only the meaningful responses:

cat /tmp/james24lab/guesses.txt | nc localhost 30002 | grep -v "Wrong"

The service printed its banner message, then Correct! and then the password for Level 25.

Password for Level 25 retrieved by brute forcing all 10000 PIN combinations in one pipeline.

Commands Used

# Connect to the Bandit server as bandit24 using the Level 24 password
ssh bandit24@bandit.labs.overthewire.org -p 2220

# List the home directory
ls -la

# Create a working directory
mkdir -p /tmp/james24lab
cd /tmp/james24lab

# Generate all 10000 password and PIN combinations
for i in $(seq -w 0000 9999); do
  echo "gb8KRRCsshuZXI0tUuR............ $i"
done > /tmp/james24lab/guesses.txt

# Verify the wordlist has the correct number of lines
wc -l /tmp/james24lab/guesses.txt

# Preview the first few lines to confirm the format is correct
head /tmp/james24lab/guesses.txt

# Submit all combinations to the service and filter for successful output
cat /tmp/james24lab/guesses.txt | nc localhost 30002 | grep -v "Wrong"

Command Breakdown

**seq -w 0000 9999** Generates a sequence of numbers from 0 to 9999. The -w flag pads each number with leading zeros to maintain a consistent width, producing 0000, 0001, 0002 and so on through 9999. This ensures every 4-digit PIN is represented in the correct zero-padded format the service expects.

**for i in $(seq -w 0000 9999); do echo "password $i"; done** Iterates through every value produced by seq and uses echo to construct a formatted line for each one. Each line contains the current level's password, a space and the zero-padded PIN. The entire loop output is redirected into guesses.txt using > at the end.

**wc -l filename** Counts the lines in the file. Verifying 10000 lines before submitting confirms the wordlist was generated correctly and no values were missed or duplicated.

**cat guesses.txt | nc localhost 30002** Pipes the entire 10000-line wordlist into a Netcat connection to port 30002. The service reads each line as a submission, processes it and responds before reading the next one. All of this happens through a single persistent connection rather than 10000 separate connections.

**| grep -v "Wrong"** Filters the service's output. The -v flag inverts the match, so only lines that do not contain the word "Wrong" are printed. Because every failed attempt produces a "Wrong" response, this filter reduces 10000 lines of output down to the banner, the Correct! confirmation and the password.

Lesson Learned

The main technical takeaway is that brute force is not about raw speed. It is about eliminating wrong answers systematically until the right one is found. Generating all 10000 combinations in a structured file before submitting them is cleaner, more reproducible and easier to verify than any interactive approach.

The grep -v "Wrong" filter is the element that makes this practical to read. Without it the output from port 30002 would be 10000 lines of "Wrong! Please enter the correct current password and pincode" before the one successful response. With the filter, only the relevant output survives. That technique, filtering large output by excluding known noise, is used constantly in log analysis and automated testing.

The seq -w flag for zero-padding is also worth committing to memory. Any time a system expects a fixed-width numeric format, seq -w produces it correctly without any additional formatting step.

• seq -w 0000 9999 — generate a zero-padded numeric sequence from 0000 to 9999
• for i in $(seq ...); do echo "text $i"; done > file — generate structured wordlists using loops
• cat file | nc host port — pipe an entire file as input into a network connection
• grep -v "pattern" — filter output by excluding lines that match a pattern
• wc -l filename — count lines in a file to verify a wordlist before use

🔴 SOC Analyst Insight

Brute force credential attacks against network services are among the most commonly detected attack types in SOC environments. Understanding how they are constructed from an attacker’s perspective directly informs the defensive signatures, rate limits and lockout policies that analysts recommend or configure. The pipeline used in this level, generate, submit and filter, is structurally identical to how real brute force tools operate at their core.

# Detect brute force attempts against SSH by looking for rapid repeated failed authentications
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20

The command above extracts source IP addresses from failed SSH authentication attempts, counts how many times each appears and sorts by frequency descending. A single IP generating thousands of failed authentication attempts in a short time window is a brute force pattern that should trigger an alert or an automatic block. Knowing how brute force pipelines work makes it significantly easier to write the detection logic that identifies them.

Key Takeaway

Brute forcing a 4-digit PIN with a bash loop and Netcat is a complete introduction to automated credential testing. The three components, generating a structured wordlist, submitting it through a network service and filtering the output for meaningful results, appear together in real security testing contexts with only the tooling changed. Understanding each component individually and how they compose into a working pipeline is what makes this level one of the most practically valuable in the entire series.

30-Day Cybersecurity Learning Journey — Progress

🟢 Open Day — Setup & Series Introduction  | OverTheWire Bandit
✅ Day 0.   — Bandit Level 0               | First Login
✅ Day 1.   — Bandit Level 1 → 2           | Special Characters
✅ Day 2.   — Bandit Level 2 → 3           | Spaces in Filenames
✅ Day 3.   — Bandit Level 3 → 4           | Hidden Files
✅ Day 4.   — Bandit Level 4 → 5           | File Types
✅ Day 5.   — Bandit Level 5 → 6           | find with Properties
✅ Day 6.   — Bandit Level 6 → 7           | find across Filesystem
✅ Day 7.   — Bandit Level 7 → 8           | grep
✅ Day 8.   — Bandit Level 8 → 9           | sort and uniq
✅ Day 9.   — Bandit Level 9 → 10          | strings and grep
✅ Day 10.  — Bandit Level 10 → 11         | base64
✅ Day 11.  — Bandit Level 11 → 12         | ROT13 and tr
✅ Day 12.  — Bandit Level 12 → 13         | hexdump and compression
✅ Day 13.  — Bandit Level 13 → 14         | SSH keys
✅ Day 14.  — Bandit Level 14 → 15         | Netcat
✅ Day 15.  — Bandit Level 15 → 16         | SSL and OpenSSL
✅ Day 16.  — Bandit Level 16 → 17         | Port Scanning
✅ Day 17.  — Bandit Level 17 → 18         | diff
✅ Day 18.  — Bandit Level 18 → 19         | SSH command execution
✅ Day 19.  — Bandit Level 19 → 20         | Setuid binaries
✅ Day 20.  — Bandit Level 20 → 21         | Network services
✅ Day 21.  — Bandit Level 21 → 22         | Cron jobs
✅ Day 22.  — Bandit Level 22 → 23         | Cron and bash scripting
✅ Day 23.  — Bandit Level 23 → 24         | Writing cron scripts
✅ Day 24.  — Bandit Level 24 → 25         | Brute forcing and loops  ← today
⬜ Day 25.  — Bandit Level 25 → 26         | coming next

Follow along with the series as I document each level, command and lesson learned.

Generate the list. Submit the list. Filter the noise. That is all brute force is at its core.