OverTheWire: Natas Level 8 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

In today’s challenge we’re going to solve level 8 from the Natas wargame.

Let’s begin.

Going to the following link, and entering the username “natas8” and password “DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe” we get the following:

Natas8_WarGame_1

Natas8_WarGame_2

OK, we see a page that is asking for an input secret. Clicking the view sourcecode link we see:

Natas8_WarGame_4

Looking at the screen, there’s PHP code with an encoded secret variable that seems to be in hexadecimal. There’s also a function titled “encodeSecret” that does the following steps:

  1. Change the binary to hex (bin2hex)
  2. Reversing the string (strrev)
  3. Base64 encoding (base64_encode)

From there the code is checking to see if our input secret equals the encoded secret. If it does then we get the code for level 9, otherwise we need to try again.

So, how are we going to solve this?

Going to Google and looking for a PHP interpreter, we’re presented with the following link.

From there, We’re going to do the reverse the steps of above. Our new steps are:

  1. Convert the hex to binary (hex2bin)
  2. Reverse the string (strrev)
  3. Base64 decode (imap_base64)

Below is the screenshot that depicts the above steps.

Natas8_WarGame_5

Doing the steps, we are presented with the decoded secret which is “oubWYf2kBq”

Going back to the level 8 page, and entering our decoded secret we get the following:

Natas8_WarGame_6

We found the flag!

OverTheWire: Natas Level 6 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

In today’s blog post we’re going t solve level 6 in the Natas wargame.

Let’s begin.

Going to the following link and entering the username of “natas6” and password of “iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq” we see the following:

Natas6_WarGame_2

Natas6_WarGame_3

Doing a right click, view source we see:

Natas6_WarGame_4

Hmm… there’s not much in here, except there’s a view sourcecode. Let’s see what this source code will yield us…

Natas6_WarGame_5

Looking at the middle of the page, we see that there’s php code (code between <?…?>), we notice that there’s an include/secret.inc. Let’s see if we can access this file and see what’s inside the file.

Changing the URL to “natas6.natas.labs.overthewire.org/includes/secret.inc” we see:

Natas6_WarGame_6

… a blank page. Let’s do a right click, view page source to see if there are nuggets hidden beneath the surface.

Doing a right click, view page source we see the following:

Natas6_WarGame_7

Hmm… looks like we find the secret.

Let’s enter this into the input box and see if this unlocks the level.

Entering the secret above into the input box we get:

Natas6_WarGame_8

Natas6_WarGame_9

We found the flag!

OverTheWire: Natas Level 5 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

In today’s blog post, we’re going to solve level 5 from the Natas wargame challenge.

Let’s begin.

Going to the following link and entering username of “natas5” and password of “iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq” we see the following:

Natas5_WarGame_1

After pressing “OK” we see:

Natas5_WarGame_5

Hmm… we see that we’re not logged in and access is disallowed.

Using Tamper Data, let’s see if the request headers show us a way to bypass the login feature.

Opening the Tamper Data application and refreshing the website we see:

Natas5_WarGame_2

Hmm… we see inside the Cookie that there is a loggedin that is currently set to zero. What if we change it to 1?

Changing the loggedin feature to 1 and pressing Enter we see:

Natas5_WarGame_4

Natas5_WarGame_3

We received the flag!

OverTheWire: Natas Level 4 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

Today’s blog post we’re going to solve level 4 from the Natas wargame.

Let’s begin.

Going to the following link we see:

Natas4_WarGame_1

After entering the username of “natas4” and password of “Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ” we get the following:

Natas4_WarGame_2

Hmm… we’re not allowed access because we’re coming from an invalid URL. Let’s see if we can change that.

In a previous blog, I explained how to user Tamper Data. Tamper Data allows you to modify HTTP requests and responses to see if the web page will behave differently.

We’re going to use Tamper Data for this challenge.

 

Starting Tamper Data, and going to the level 4 we see:

Natas4_WarGame_4

We see that the referrer shows natas4, what happens when we change it to natas5?

 

Changing the referrer to natas5, and clicking OK we see:

Natas4_WarGame_5

Natas4_WarGame_6

We found the flag!

OverTheWire: Natas Level 3 – #appsec #webapp #websecurity #wargames

Another day, anther challenge…

In today’s challenge we will solve level 3 from the Natas wargame. Let’s begin.

Going to the following link, and entering the username of “natas3” and password we retrieved from the second challenge we see:

Natas3_WarGame_1

Password from level 2:

Natas2_WarGame_6

Pressing Enter we see:

Natas3_WarGame_2

Doing a right click, view source we see:

Natas3_WarGame_3

Hmm… we have a hint. “No more information leaks!! Not even Google will find it this time…”

Knowing a thing or two about how Google indexes websites, I know that some websites use a robots.txt file. Let’s see if this website is using that.

Entering “robots.txt” at the end of the URL we see:

Natas3_WarGame_4

OK – the first parameter user-agent specifies that any agent is allowed. We’re disallowing the /s3cr3t/ folder. Let’s go to this folder and see what’s there…

Entering the /s3cret/ folder we see:

Natas3_WarGame_5

Hmm… there’s a users.txt file. Let’s see what’s there.

Natas3_WarGame_6

We found the password for level 4!

OverTheWire: Natas Level 2 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

In today’s blog post we’re going to solve level 2 from the Natas wargame.

Let’s begin.

Going to the following link we see:

Natas2_WarGame_1

We’ve acquired the password for level 2 from the level 1 challenge (screenshot below):

Natas1_WarGame_3

Entering the username of “natas2” and password from the above screenshot we see the following:

Natas2_WarGame_2

Nothing on the page, eh… I don’t believe that.

Let’s try, right click view source and see what we get.

Natas2_WarGame_3

We notice there’s an image source of a pixel.

Clicking this link we see:

Natas2_WarGame_4

It truly is just a pixel. What if we remove the “pixel.png”? Maybe there are other files on the system. Let’s try it.

Removing the “pixel.png” and pressing Enter we see:

Natas2_WarGame_5

We see an extra file – users.txt. I wonder what’s in it.

Clicking users.txt, we noticed that it lists the different username and passwords. The one we want is the fourth row – natas3. We’ve found natas3 password!

OverTheWire: Natas Level 1 – #appsec #webapp #websecurity #wargames

Another day, another challenge…

In today’s blog post we’re going to solve level 1 of the Natas challenge.

Let’s begin.

Going to the following URL we see:

Natas1_WarGame_1

From level 0, we were able to find the password of level 1 (screenshot below):

Natas_WarGame4

Entering the username of “Natas1” and password from the screenshot we see:

Natas1_WarGame_2

Looking at the message we noticed that right-clicking has been blocked. How can we get around this?

By adding “view-source” in the beginning of the URL.

Doing this we see:

Natas1_WarGame_3

We’ve acquired the password for level 2!