DUDJI.ZINE/WRITEUPSPERSONAL NOTES. PUBLIC KNOWLEDGE.
WRITEUPS /CHALLENGES

Natas 3

Natas Level 3 — a disallowed path in robots.txt reveals a hidden directory.

Overview

FieldValue
URLhttp://natas3.natas.labs.overthewire.org
Usernamenatas3
Password3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH

The page says: "There is nothing on this page." The source is also clean — no referenced files this time.

There is, however, a comment in the source:

<!-- No more information leaks!! Not even Google will find it this time... -->

"Not even Google" is the key phrase here.

Hints

Hint 1 — How does Google find pages?

Search engine crawlers discover pages by following links. Website owners can instruct crawlers to skip certain paths using a well-known standard file in the web root. What is that file called, and what does it contain?

Hint 2 — What's in robots.txt?

Navigate to /robots.txt. The file uses Disallow: directives to tell crawlers which paths to avoid. These paths are hidden from search engines — but not from you. Whatever is listed there is worth visiting.

Solution

Full walkthrough

  1. Read robots.txt

    Navigate to http://natas3.natas.labs.overthewire.org/robots.txt:

    User-agent: *
Disallow: /s3cr3t/

  2. Browse the disallowed directory

    Navigate to http://natas3.natas.labs.overthewire.org/s3cr3t/.

    Directory listing is enabled, exposing users.txt.

  3. Read users.txt

    Open users.txt to retrieve the password:

    natas4:QryZXc2e0zahULdHrtHxzyYkj59kUxLQ

With curl

# Read robots.txt to find the hidden path
curl -s -u natas3:3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH \
  http://natas3.natas.labs.overthewire.org/robots.txt

# Read the disallowed directory's credentials file
curl -s -u natas3:3gqisGdR0pjm6tpkDKdIWO2hSvchLeYH \
  http://natas3.natas.labs.overthewire.org/s3cr3t/users.txt

Password

natas4: QryZXc2e0zahULdHrtHxzyYkj59kUxLQ