Over the wire Natas Level 6

Over the wire Natas Level 6

Objective:

Get password for Level 7

Solution:

So we have a text box with the label Input Secret and a submit query button

Lets check the source code again.

Here it looks like the form is taking our password we provide and checking it against another password stored In a variable $_Post[‘secret’]

<?

include "includes/secret.inc";

    if(array_key_exists("submit", $_POST)) {

        if($secret == $_POST['secret']) {

        print "Access granted. The password for natas7 is <censored>";

    } else {

        print "Wrong secret";

    }

    }

?>

Let’s see if we can just get to that file /includes/secret.inc and see if we can see the key in there

http://natas6.natas.labs.overthewire.org/includes/secret.inc

Looks like just a blank white page… but it did load so the thing exists, lets check the source for it

<?

$secret = "FOEIUWGHFEEUHOFUOIU";

?>

Let’s punch that into the validation box and see if we get the password for the next level

Access granted. The password for natas7 is 7z3hEENjQtflzgnT29q7wAvMNfZdh0i9