Overview
| Field | Value |
|---|---|
| URL | http://natas4.natas.labs.overthewire.org |
| Username | natas4 |
| Password | QryZXc2e0zahULdHrtHxzyYkj59kUxLQ |
The page responds with:
Access disallowed. You are visiting from "http://natas4.natas.labs.overthewire.org/index.php" while authorized users should come only from "http://natas5.natas.labs.overthewire.org/"
The server is checking where your request originated. This is a clue — the check is being done on something your browser sends with every request.
Hints
Hint 1 — What tells the server where you came from?
HTTP requests include headers beyond just the URL. One header is specifically designed to tell the server which page you were on when you made the request. Look at your request in a proxy like Burp Suite — which header contains the originating URL?
Hint 2 — Can you set that header yourself?
The Referer header is set by the browser to indicate the page that triggered the request. However, HTTP headers are just text in the request — any proxy or HTTP client lets you add or modify them freely. What value would make the server think you came from natas5?
Solution
Full walkthrough
Intercept the request in Burp Suite
Open Burp Suite with the proxy enabled. Reload the natas4 page to capture the
GET /index.phprequest.Add the spoofed Referer header
In the intercepted request, add the following header:
Referer: http://natas5.natas.labs.overthewire.org/Forward and read the response
Forward the modified request. The server accepts it and returns the password for natas5.
With curl
# -H sets a custom request header — used here to spoof the Referer
curl -s -u natas4:QryZXc2e0zahULdHrtHxzyYkj59kUxLQ \
-H "Referer: http://natas5.natas.labs.overthewire.org/" \
http://natas4.natas.labs.overthewire.org/ \
| grep -i password
Password
natas5: 0n35PkggAPm2zbEpOU802c0x0Msn1ToK