Tuesday, October 30, 2012

OverTheWire Wargame "Natas" Level 2 [How-To/Web]

So Level 1 wasn't that bad, either. Let's start Level 2 with the credentials that we found in the previous level.

When we load up level 2, we are presented with this:

Kind of ironic since there's text, right?

Let's once again take a look at the source (this is becoming a thing!):

Hmm, just the normal text... and wait, an image? The <img src...> code is HTML for embedding a picture into a webpage. It's located at files/pixel.png, so we know it's on whatever server is running this webpage.

Let's try to navigate to it!

Well, if you opened it like I did, it's just a white page. That makes sense since it's just one pixel. But we know it exists on the server, and there has to be a folder called files. Lets see if we can get to that folder...

That's something we like to see, a directory listing! We can also see there's another file called "users.txt" in there!
Opening users.txt gives us:
Yay, a password for natas3!
We enter the natas3:lOHYKVT34rB4agsz1yPJ2QvENy7YnxUb on the next level and continue on...


  1. I Will Provide Seo Blog Comment Service. & niche relevant blog comment service we provide a quality service with 100% Buyer satisfaction and My team Believed in Quality work not Quantity Contact me Now 24/7.

  2. Female Escorts: To protect Esther in the harem, and to forestall discrimination and hostility toward her, Mordecai ordered Esther to cover her Jewishness. She wasn't to celebrate Jewish customs and laws and was to avoid drawing attention to herself inside the harem by insisting on kosher food.
    Female Escorts,High Class Call Ladies,Escorts Ladies,Escorts ,Escorts close to me
    Female Escorts

  3. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.
    Devops training in Chennai
    Devops training in Bangalore
    Devops training in Pune
    Devops Online training
    Devops training in Pune
    Devops training in Bangalore
    Devops training in tambaram

  4. This blog provides a strong evidence of phenomenal writing.
    Instaport password hacker

  5. this is really nice to read..informative post is very good to read..thanks a lot! Defective Medical Device

  6. It is really amazing...thanks for sharing....provide more useful information...
    Devops Training in Chennai | Devops Training Institute in Chennai

  7. Your very own commitment to getting the message throughout came to be rather powerful and have consistently enabled employees just like me to arrive at their desired goals.
    Matlab Training in Chennai | Matlab Course Training in Chennai
    AWS Training in Chennai | Best AWS Course Training in Chennai
    Devops Training in Chennai | Best Devops Course Training in Chennai

  8. Thank for sharing a great article. I wish I will find a more useful article from you
    AWS Training in Chennai
    Python Training in Chennai

  9. I like the dial fake Franck Muller design with its traditional printed fake Vacheron Constantin Arabic hour numerals and a barley corn pattern-aesthetic stamped into the dial. This is designed to mimic the look of guilloche-engraved replica watches dials, but to get authentic machine engraving on a dial replica watches uk you need to step up to a Breguet timepiece which is a fake rolex sibling to Longines within the Swatch Group. Longines replica rolex uses blued-steel hands properly and without many reflective surfaces fake watches on the dial, it makes for a highly legible watch. Also, there is a subtly-domed AR-coated sapphire crystal rolex replica over the dial which does not suffer from glare issues, thankfully. In addition to attention to fake rolex uk legibility, build quality is also a focus and the watch serves as a real tool-style instrument fake watches uk which is something very apparent in most of the Longines Master Collection products.

    High-end fashion classic replica watches, worth collecting.www.vipwatches.co