Natas is a capture the flag (CTF) track that teaches web security on OverTheWire (OTW). You are presented with a webpage and your goal is to somehow get a password to the next level, another password-protected website. This involves some sort of exploit like SQL injection, XSS, or a vulnerability in the source code of the site. Not only is it a lot of fun, but it’s also a great way to learn about web security.
While it’s possible to ask for help if you get stuck, most of the time I ended up looking for a solution online. This felt like cheating and many times I realized I was very close to solving the challenge, I just needed a hint in the right direction.
This is what this page is about. Instead of posting full solutions to the challenges, I will post hints that will hopefully help you solve Natas challenges without spoiling too much of the fun.
If you’re part of the OTW team and would like any of these hints to be taken down or changed, let me know. Comments to improve them, by anyone, are also welcome.
Before you begin: don’t spoil the fun
It’s completely normal to struggle with the challenges. It’s during that struggle that you will learn the most, IMO. So, as much as possible, avoid using these hints. I’m posting them here only as a last resort, after attempting different approaches, and as a better option than getting the solutions directly.
These hints are also biased because they are based on my experience. They will hint you towards solving the challenge how I was able to solve it, but maybe there are other ways to solve them or you would just approach them differently. So, beware.
While the challenges are different, in most of them it will be helpful to:
- Study the source code. Most challenges provide it, including the PHP backend code.
- Read the docs.
Be sure you completely understand what the code is doing. Many times you will get exploit ideas during this process. The docs might also point out vulnerabilities or practices to avoid (which could be exploited).
Also, give it some time. Maybe, at first, you will have no idea what to do. Take a rest, do something else, save the challenge for later. New ideas will pop up during this time. That’s another reason to avoid using the hints directly.
Just click on the arrows and the “+” buttons to reveal the hints.
This is as far as I got. I will update the hints as I solve more challenges.