OtherSelf-paced; Bandit takes most beginners a few evenings, the full set of wargames takes months·Free

OverTheWire Wargames (Bandit, Natas, Krypton and more)

4.6

Bandit is still the best free introduction to the Linux shell I know of, and it is the thing I tell people to do before they touch any AI security course. No AI content at all. That is fine. You cannot judge what an AI agent did on a box if you cannot move around the box yourself.

What We Liked

Completely free, no account, no upsell, no email capture
Bandit teaches real command line skills by making you use them to find the next password
Clear progression: Bandit first, then pick web, crypto or reversing, then binary exploitation
Played over plain SSH, so you learn the tools you will actually use at work
Huge community of write-ups and a chat for when you get stuck

What Could Be Better

Zero AI or LLM content, so it is a prerequisite, not an AI course
Very little hand-holding: each level gives you a hint and a list of commands to read up on, and that is it
No certificate or badge, so there is nothing to show an employer except what you can do
Spoiler write-ups are one search away, which makes it easy to cheat yourself
Some of the later binary games show their age

Detailed review

OverTheWire is a volunteer project that has been hosting security wargames for well over a decade. You connect to each game over SSH, solve the level, and the solution gives you the password for the next one. The site suggests starting with Bandit, then picking one of Natas (web), Krypton (crypto) or Leviathan (reversing), and later moving on to Narnia, Behemoth, Utumno and Maze for binary exploitation. Bandit is the reason most people show up. It starts with logging in over SSH and reading a file, and works up through permissions, find, grep, pipes, encoding, networking with netcat and openssl, cron jobs, git and setuid binaries.

Every level hands you a short list of commands that might help and leaves the rest to you. That forced reading of man pages is the whole value. I have watched people who finished a paid Linux course get stuck on Bandit level 5, which says a lot about the paid course. Why review it on an AI course site? Two reasons. First, the AI security courses I rate highest, like HTB's AI Red Teamer path or TCM's PAPA, assume you are comfortable on a Linux shell.

Plenty of people are trying to jump straight to prompt injection without that, and they hit a wall. Second, AI coding agents and AI SOC tools now run shell commands on your behalf. If you cannot read what an agent just ran and tell whether it was sensible, you are trusting it blind. The downsides are the flip side of the format. There are no lectures, no videos and no certificate.

If you need structure and explanation, you will find it frustrating, and you will be tempted to read a write-up for every level, which defeats the point. My rule for people I mentor: you can read a write-up only after you have been stuck for an hour, and then you redo the level from scratch the next day. Natas deserves a separate mention for anyone heading toward LLM application security. It is a web security game played in the browser, and many of the bugs it teaches, like trusting client input and leaking secrets through sloppy filters, are the same classes of mistake people are now making when they wire LLMs into web apps. Overall, there is no better free starting point. It will not teach you AI.

It will teach you the ground that AI tools are now standing on.

[ final ]

The verdict.

Do Bandit, all of it, without reading write-ups. Then do Natas if you are heading toward AI application security. It costs nothing and it will make every paid course you take afterwards make more sense.