Natas - Level 4

Connection information

  • Username: natas3
  • Password: sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14
  • URL: http://natas3.natas.labs.overthewire.org

Information given

The white box says ”There is nothing on this page” (again).

Getting the password

Here is the page’s code (without the header):

<body>
<h1>natas3</h1>
<div id=”content”>
There is nothing on this page
<!−− No more information leaks!! Not even Google will find it this time... −−>
</div>
</body></html>

All right, it said Google couldn’t find it, which probably means something about robots.txt. How about we take a look at it? We navigate to http://natas3.natas.labs.overthewire.org/robots.txt and see this:

User−agent: 
Disallow: /s3cr3t/

It looks like the folder named s3cr3t is disallowed. If we navigate to http://natas3.natas.labs.overthewire.org/s3cr3t/ we see an index of /s3cr3t, with a file named users.txt.

/s3cr3t/users.txt
natas4:Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ