Learn hacking skills legally with capture-the-flag games
Every analyst, pentester and incident responder you'll ever meet learned the same way: small puzzles on servers built to be played with. OverTheWire's Bandit is the classic first game, free, no account, played over SSH. Work through the first ten levels with nudges instead of answers, so the Linux skills behind each one actually stick, then move on to picoCTF and the other legal platforms where the real practice happens.
- A method for getting unstuck that works on every CTF: read the goal, read the man page, try, then take one hint
- A route onwards: picoCTF, OverTheWire's next games, and the platforms people use to build a security career
- A terminal with SSH: Windows Terminal or PowerShell (OpenSSH is built into Windows 10 and 11), macOS Terminal, or any Linux
- For the offline lab on Windows: Git Bash (comes with Git for Windows) or WSL
- New to the command line? Do Terminal survival kit first
How CTFs work, and the rules of the game
Know what you're doing, why it's legal, and the one rule OverTheWire asks of you.
A capture-the-flag game is a set of puzzles where each solution reveals a secret (a 'flag' or, in Bandit, the password for the next level). The servers are built to be played on, by thousands of people at once, with permission. That's what makes it legal: you're invited.
The rule to keepOverTheWire asks players not to publish level passwords or spoil the game for others. This mission follows that: it teaches the idea behind each level and gives nudges, never the passwords or full solutions. Keep your own passwords in a private file or your password manager, never in a public repo or post.
Each level is one skill. By level 10 you can find and decode things the way analysts do. The method for every levelread the level goal twice; read the commands it suggests; open their manual with
man command(or search 'command examples'); try something; and only when you've been stuck for 15 minutes, open the next hint below. One hint at a time.