DUDJI.ZINE/WRITEUPSPERSONAL NOTES. PUBLIC KNOWLEDGE.
WRITEUPS /CHALLENGES

Natas 1

Natas Level 1 — right-click is blocked via JavaScript, but keyboard shortcuts bypass it entirely.

Overview

FieldValue
URLhttp://natas1.natas.labs.overthewire.org
Usernamenatas1
Password0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq

The page says: "You can find the password for the next level on this page, but rightclicking has been blocked!"

The source contains this handler:

<body oncontextmenu="javascript:alert('right clicking has been blocked!'); return false;">

The password is still in the source — same as Level 0. The only obstacle is accessing that source without right-clicking.

Hints

Hint 1 — What is actually being blocked?

Only the right-click context menu is blocked — and only by JavaScript running inside the browser. JavaScript can block the context menu event, but it cannot block your browser's own built-in features. What other methods does your browser offer to view source?

Hint 2 — Browser keyboard shortcuts

Most browsers have a keyboard shortcut to view the page source that has nothing to do with right-clicking. Try Ctrl+U. You can also use the browser address bar directly by typing view-source: before the URL.

Solution

Full walkthrough

  1. Bypass the right-click block

    Press Ctrl+U to open the page source directly — the JavaScript block on right-click doesn't affect this shortcut. Alternatively, type view-source:http://natas1.natas.labs.overthewire.org in the address bar.

  2. Find the HTML comment

    The password sits in the same HTML comment pattern as Level 0:

    <!--The password for natas2 is TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI -->

With curl

curl -s -u natas1:0nzCigAq7t2iALyvU9xcHlYN4MlkIwlq \
  http://natas1.natas.labs.overthewire.org/ \
  | grep -i password

Password

natas2: TguMNxKo1DSa1tujBLuZJnDUlCcUAPlI