# 📊 OverTheWire Bandit Level 18: Finding Differences Between Files with diff Level 18 introduces the **`diff` command**—a powerful tool for comparing files and finding differences. When you have two similar files and need to find what changed, `diff` shows you exactly what's different. This is essential for code reviews, configuration management, and finding changes in files. **Level 18 teaches you:** - Using `diff` to compare two files - Understanding `diff` output format - Identifying which file contains which content - Finding the only changed line between files - Reading `diff` output symbols (`<` and `>`) This level builds on text processing skills from earlier levels. Understanding `diff` is useful for analyzing changes, comparing configurations, and finding differences in files. --- ## 🎯 The Objective After logging into `bandit17`, your goal is to find the password for Level 18. There are two files in the home directory: **`passwords.old`** and **`passwords.new`**. The password for the next level is in `passwords.new` and is **the only line that has been changed** between the two files. **What Level 18 teaches:** - Using `diff` to compare files - Understanding `diff` output format - Identifying changed lines - Reading file comparison symbols - Finding differences efficiently **The challenge:** Both files contain many passwords. Only one line differs between them. Use `diff` to find which line changed—that's the password for Level 18. **Note:** If you see "Byebye!" when trying to log into bandit18, that's related to the next level (bandit19), not this one. --- ## 🔍 Understanding the Problem Let's start by connecting to Level 17 and seeing what we're dealing with: ```bash sshpass -p `cat bandit17` ssh bandit17@bandit.labs.overthewire.org -p 2220 ``` Once connected, let's check what files are in the home directory: ```bash ls -la ``` You should see two files: - `passwords.old` — Old password file - `passwords.new` — New password file **The problem:** How do you find the one line that changed between these two files? The answer: Use `diff` to compare the files. It will show you exactly which line is different. --- ## 🧠 Understanding the `diff` Command Let's dive deeper into `diff`, because understanding it is crucial: ### What Is `diff`? The `diff` command compares two files and shows the differences: - **Shows what changed** — Lines that differ between files - **Shows context** — Surrounding lines for reference - **Shows location** — Line numbers where differences occur **Basic usage:** ```bash diff file1 file2 ``` **What it does:** - Compares `file1` and `file2` line by line - Shows lines that differ - Uses symbols to indicate which file has which content ### Understanding `diff` Output `diff` uses symbols to show differences: **`<`** — Content from the **first file** (left file) - In `diff passwords.old passwords.new`, `<` means content from `passwords.old` **`>`** — Content from the **second file** (right file) - In `diff passwords.old passwords.new`, `>` means content from `passwords.new` **`---`** — Separator between file sections **Line numbers** — Shows where differences occur **Example output:** ``` 42c42 < old_password_line --- > new_password_line ``` **Breaking this down:** - `42c42` — Line 42 changed (c = change) - `< old_password_line` — Content from first file - `---` — Separator - `> new_password_line` — Content from second file **For Level 18:** The `>` line (from `passwords.new`) is the password for Level 18. --- ## 📋 Step-by-Step Walkthrough ### Step 1: Connect to Level 17 ```bash sshpass -p `cat bandit17` ssh bandit17@bandit.labs.overthewire.org -p 2220 ``` ### Step 2: Check the Files List files in the home directory: ```bash ls -la ``` You should see `passwords.old` and `passwords.new`. ### Step 3: Compare the Files with `diff` Use `diff` to compare the two files: ```bash diff passwords.old passwords.new ``` **Breaking this down:** - `diff` — File comparison command - `passwords.old` — First file (old passwords) - `passwords.new` — Second file (new passwords) **What you'll see:** The output will show the differences between the files. It might look something like: ``` 42c42 < kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd --- > w0Yfolrc5bwjS4qw5VE1ekH6yqF6UZJ5 ``` **Breaking down the output:** - `42c42` — Line 42 changed (c = change) - `< kfBf3eYk5BPBRzwjqutbbfE887SVc5Yd` — Old password (from `passwords.old`) - `---` — Separator - `> w0Yfolrc5bwjS4qw5VE1ekH6yqF6UZJ5` — New password (from `passwords.new`) ### Step 4: Extract the Password The password for Level 18 is the line marked with `>` (from `passwords.new`). In the example above, it's `w0Yfolrc5bwjS4qw5VE1ekH6yqF6UZJ5`. Copy that password—that's your password for Level 18. ### Step 5: Save the Password Copy the password and save it on your local machine: **On Linux/macOS:** ```bash echo "PASSWORD_HERE" > bandit18 ``` **On Windows (PowerShell):** ```powershell "PASSWORD_HERE" | Out-File -FilePath bandit18 -NoNewline ``` ### Step 6: Connect to Level 18 ```bash sshpass -p `cat bandit18` ssh bandit18@bandit.labs.overthewire.org -p 2220 ``` **Note:** If you see "Byebye!" when trying to log in, that's related to Level 19, not Level 18. The password is correct—you'll learn about this in the next level. --- ## 💡 Understanding `diff` Output Formats Let's dive deeper into `diff` output, because it can vary: ### Change (c) **Format:** `line1,line2cline3,line4` **Meaning:** Lines changed **Example:** ``` 42c42 < old_line --- > new_line ``` **What it means:** Line 42 in first file changed to line 42 in second file. ### Addition (a) **Format:** `line1aline2` **Meaning:** Lines added **Example:** ``` 42a43 > new_line ``` **What it means:** New line added after line 42. ### Deletion (d) **Format:** `line1,line2dline3` **Meaning:** Lines deleted **Example:** ``` 42d41 < old_line ``` **What it means:** Line 42 deleted (was line 41 in second file). **For Level 18:** You'll typically see a change (c), showing one line that changed. --- ## 🛠️ Alternative Methods Here are different ways to find the difference: ### Method 1: `diff` Command (Recommended) ```bash diff passwords.old passwords.new ``` **Pros:** Simple, clear, shows exactly what changed **Cons:** None really ### Method 2: Using `comm` ```bash comm -13 passwords.old passwords.new ``` **Pros:** Shows only lines unique to second file **Cons:** Requires sorted files, less intuitive ### Method 3: Using `grep` with `-v` ```bash grep -v -f passwords.old passwords.new ``` **Pros:** Shows lines in second file not in first **Cons:** More complex, might show multiple lines if format differs ### Method 4: Manual Comparison (Not Recommended) ```bash cat passwords.old cat passwords.new # Manually compare line by line... ``` **Pros:** Simple, no new commands **Cons:** Extremely slow, error-prone, nearly impossible with many lines **For Level 18, use Method 1** — it's the most efficient and teaches you valuable skills. --- ## 🔒 Real-World Context **Why does this matter in penetration testing?** In real security assessments, you'll constantly compare files: ### 1. **Configuration File Analysis** Comparing configuration files: - Before and after changes - Different versions - Backup vs. current **Example:** Finding configuration changes: ```bash diff /etc/ssh/sshd_config.backup /etc/ssh/sshd_config ``` ### 2. **Code Analysis** Comparing code versions: - Finding changes in source code - Identifying modifications - Code reviews **Example:** Finding code changes: ```bash diff old_version.py new_version.py ``` ### 3. **Log File Analysis** Comparing log files: - Finding new entries - Identifying changes - Detecting anomalies **Example:** Finding new log entries: ```bash diff log_old.txt log_new.txt ``` ### 4. **Password List Comparison** Comparing password lists: - Updated wordlists - Changed credentials - New passwords **Example:** Finding new passwords: ```bash diff passwords_old.txt passwords_new.txt ``` ### 5. **Backup Comparison** Comparing backups: - Finding what changed - Identifying modifications - Verifying backups **Example:** Comparing backup files: ```bash diff backup_old.tar backup_new.tar ``` ### 6. **Forensics** In digital forensics: - Comparing file versions - Finding modifications - Identifying changes **Example:** Finding file changes: ```bash diff original_file.txt modified_file.txt ``` **The skill you're learning:** How to efficiently compare files and find differences. This is essential when: - Analyzing configuration changes - Comparing code versions - Finding modifications in files - Identifying what changed between backups - Performing file analysis --- ## 🚨 Common Mistakes ### Mistake 1: Reading the Wrong Line **Wrong:** ```bash diff passwords.old passwords.new # Reads the < line (from passwords.old) instead of > line ``` **Right:** ```bash diff passwords.old passwords.new # Reads the > line (from passwords.new) - that's the password ``` **Why:** The `>` symbol indicates content from the second file (`passwords.new`), which contains the new password. The `<` symbol is from the first file (`passwords.old`), which has the old password. ### Mistake 2: Not Understanding `diff` Symbols **Confusion:** "What do `<` and `>` mean?" **Clarification:** - `<` — Content from the **first file** (left file, `passwords.old`) - `>` — Content from the **second file** (right file, `passwords.new`) - `---` — Separator between file sections **For Level 18:** The password is the line with `>` (from `passwords.new`). ### Mistake 3: Wrong File Order **Wrong:** ```bash diff passwords.new passwords.old # Reverses the order, < and > meanings swap ``` **Right:** ```bash diff passwords.old passwords.new # Correct order: old first, new second ``` **Why:** The order matters! `diff file1 file2` means: - `<` = content from `file1` - `>` = content from `file2` If you reverse the order, the symbols swap meanings. ### Mistake 4: Not Reading the Complete Output **Wrong:** ```bash diff passwords.old passwords.new | head -1 # Only sees line numbers, misses the actual difference ``` **Right:** ```bash diff passwords.old passwords.new # Reads complete output to see the changed line ``` **Why:** `diff` output includes line numbers AND the actual changed content. You need both to find the password. ### Mistake 5: Confusing "Byebye!" Message **Confusion:** "I see 'Byebye!' when logging in—did I get the wrong password?" **Clarification:** - The "Byebye!" message is **not** an error - It's related to Level 19, not Level 18 - Your password is correct - You'll learn about this in the next level **For Level 18:** If you see "Byebye!", the password is correct. This is expected behavior for Level 19. --- ## 💻 Practice Exercise Try these to reinforce what you learned: 1. **Create test files:** ```bash echo -e "line1\nline2\nline3" > file1.txt echo -e "line1\nline2_changed\nline3" > file2.txt ``` 2. **Compare them:** ```bash diff file1.txt file2.txt # Shows the difference ``` 3. **Understand the output:** ```bash diff file1.txt file2.txt # < means from file1.txt # > means from file2.txt ``` 4. **Try reversed order:** ```bash diff file2.txt file1.txt # Notice how < and > swap ``` 5. **Clean up:** ```bash rm file1.txt file2.txt ``` --- ## 🎓 Understanding `diff` Options This is a good time to understand common `diff` options: ### `-u` (Unified Format) **Shows unified diff format:** ```bash diff -u file1 file2 ``` **More readable format with context lines** ### `-c` (Context Format) **Shows context around changes:** ```bash diff -c file1 file2 ``` **Includes surrounding lines for context** ### `-i` (Ignore Case) **Case-insensitive comparison:** ```bash diff -i file1 file2 ``` **Ignores case differences** ### `-w` (Ignore Whitespace) **Ignores whitespace differences:** ```bash diff -w file1 file2 ``` **Ignores spaces and tabs** **For Level 18:** Basic `diff` is sufficient, but these options are useful for more complex comparisons. --- ## 🔗 What's Next? Level 19 introduces **SUID binaries**—executables that run with the permissions of the file owner, not the user running them. You'll learn about privilege escalation and how to exploit misconfigured SUID binaries. **Before moving on, make sure you:** - ✅ Successfully used `diff` to compare files - ✅ Understand what `<` and `>` symbols mean - ✅ Can identify which file contains which content - ✅ Know that `>` means content from the second file - ✅ Understand that "Byebye!" is related to Level 19, not Level 18 --- ## 📚 Key Takeaways After completing Level 18, you should understand: 1. **`diff` command** — Compares two files and shows differences 2. **`<` symbol** — Content from the first file (left file) 3. **`>` symbol** — Content from the second file (right file) 4. **File comparison** — Finding what changed between files 5. **Output reading** — Understanding `diff` output format --- ## 🎯 Quick Reference | Problem | Solution | Example | |---------|----------|---------| | Compare files | Use `diff` | `diff file1 file2` | | Find differences | Read `>` lines | `diff old new` shows `>` from new | | Unified format | Use `-u` | `diff -u file1 file2` | | Ignore case | Use `-i` | `diff -i file1 file2` | | Context lines | Use `-c` | `diff -c file1 file2` | --- **Questions about Level 18 or using the `diff` command?** Reach out directly: - **Email:** [m1k3@msquarellc.net](mailto:m1k3@msquarellc.net) - **Phone:** [(559) 670-3159](tel:+15596703159) - **Schedule:** [Book a free consultation](https://calendly.com/m1k3-msquarellc) --- **M Square LLC** Cybersecurity | Penetration Testing | No-Nonsense Advice

#diff command

OverTheWire Bandit Level 18: Finding Differences Between Files with diff

Related Tags