Part time CTF Player learn every day!!
🌠 I Love Hoshimachi Suisei!! 🌠
🌠 I Love Hoshimachi Suisei!! 🌠
🌠 I Love Hoshimachi Suisei!! 🌠
🌠 I Love Hoshimachi Suisei!! 🌠
OverTheWire Natas Level 0 tutorial!!
Published on 12 Dec 2023
Login
Natas uses HTTP Basic Auth.
Open http://natas0.natas.labs.overthewire.org in your browser. When prompted, log in with:
- Username:
natas0 - Password:
natas0
💡 Tip: You could also use
curl -u natas0:natas0 <URL>from the terminal, but throughout this series we focus on solving directly in the browser.
Task
The password for the next level (natas1) is hidden in the page’s HTML source.
A little bit of Theory
- Basic Auth: the browser automatically sends
Authorization: Basic ...with your credentials once logged in. - View Page Source shows the raw HTML delivered by the server. This is different from the DOM inspector.
- Windows/Linux:
Ctrl+U - macOS:
⌥ Option + ⌘ Command + U
- Windows/Linux:
- Sensitive info is often tucked away in HTML comments:
<!-- ... -->.
Further reading:
Solution
- Log in with
natas0 / natas0. - Right-click → “View Page Source” (or press the shortcut).
- Search for an HTML comment that contains the password for
natas1.
- Copy the password carefully — no extra spaces or newlines.
- Go to the next level:
- URL: http://natas1.natas.labs.overthewire.org
- Username:
natas1 - Password: (the one you just found)
Password
0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq
Troubleshooting
- Getting re-prompted for credentials? → Double-check username/password casing.
- Can’t see the comment? → Ensure you are viewing Page Source, not Elements in DevTools.
- Still unsure? → Try another browser or fetch HTML with
curlas a fallback.
Congrats 🎉 You cracked your very first Natas level by simply looking under the hood of the web page!
Thanks for reading!
Until next time — Otsumachi!! 💖☄️✨
all tags
GOT-overwrite aboutme aead ai alphanumeric-shellcode apt argc0 argon2 aslr assembly asymmetric atoi automation backbox bandit base64 bash beginner behemoth binary binary-exploitation binary-to-ascii blackarch blind blind-sqli blogging blue-team bruteforce buffer-overflow buffer-overwrite c caesar canary capabilities checksec command-injection commonmark cookie cron crypto cryptography ctf cutter cyberchef cybersecurity defenders detection dev directory-traversal dnf docs drifter ecc education elf env envp exploitation finale forensics format-string formulaone frequency frequency-analysis gcc gdb getchar gfm ghidra github-pages governance gpg guide hashing hkdf http jekyll jmpbuf kali kasiski kdf kernel keylength kramdown krypton lab ld_preload leviathan lfi lfsr linux linux-syscall llmops log-poisoning ltrace manpage markdown maze memcpy mitigations mitmproxy mlops narnia natas networking newline-injection nonce nop-sled nx object-injection obsidian openssl osint overflow overthewire package-manager pacman parrot path path-hijacking pathname php pie pkc pki pointer-trick pqc priv-esc privilege-escalation provable-security pwn pwntools pyshark python race-condition radare2 rag randomness recon red-team redirect relro requests ret2env ret2libc reverse-engineering reversing ricing roadmap rop rot13 rsa scapy security seed seo serialization session setjmp-longjmp setuid shell shellcode smoke soc sockets sprintf sql-injection srop stack-canary stack-overflow strace strcmp strcpy streamcipher strings strncpy strtoul substitution suid suisei symlink symmetric terminal test threat-intel time-based tls troubleshooting tshark type-juggling ubuntu udp utumno vigenere virtualbox virtualization vmware vortex walkthrough web windows wireshark writing wsl x86