OverTheWire Natas Walkthrough - Level 0 - 4

Key Takeaways

hey guys hackersploit here back again with another video welcome back to the over the wire war games challenges uh in this video and in future videos of course i'm gonna be taking a look at over the y and natus and uh as i said i'm going chronologically so we've completed bandit we're now going to natus and uh apart from bandit and krypton i believe i haven't done any of these other war games so this is going to be very interesting um so let's click on natives and let's see what we're dealing with so you can see that natus tells us right away natives teaches the basics of server-side web security all right so this is going to be focusing on web application security uh stuff like that um so uh the proxy that i've decided to use for this video series is going to be osap now the reason i'm using wasp zap is because uh number one it's a free and open source software and i just believe that uh you should be using that if you do have the option and it's just as good as burp suite but of course burp so it is looked as the def the as the de facto option uh but i'm going to be showing you what um i'm going to be doing with uh with osap so that you can learn as as i'm going through it as well and i'll be trying to explain all these steps i'm taking one last thing i'm going to be sorting out these videos based on the on the vulnerability that each level is going to be focusing on and yeah so let's get started so it tells us that each level of nature's consists of its own website located at and it gives us the url here so http nativex.net.labs.otherwise.org where x is the level number there is no ssh login to access a level so we're primarily dealing with web applications so enter the username for that level which is going to be native 0 4 level 0 and its password each level has access to the password of the next level your job is to somehow obtain the next password and level up all passwords are also stored in etsy natives web pass so it looks like we'll be dealing with a server or some command injection at some point because it actually gives us the directories as to where the passwords for the next levels are stored so for example the password for is five is stored uh in the files at seednatus webpass natives five and the only readable by natives four and eight is five all right so uh we start here it gives us a username and password in the url so let's open that up immediately so i'm just going to copy this and open link in the new tab and we'll enter the credentials so nato0 and let's get this show on the road so i'm not going to save the password so it looks like we don't have an ssl certificate and yeah all right so this looks like a fairly basic site we have the we have a nav bar at the top without any menu items we also have this little container telling us that you can find the password for the next level on this page so let's just check the source view the source of the page so the stuff in the headers nothing to do with the page it looks like we get a this looks like a javascript variable that gives us the level that we're on and the password for that level which is quite helpful we'll also be playing with that and we also have a comment that gives us the posit for native s1 so yeah that was extremely basic this is one of the things i this is one of the vulnerabilities you hardly find nowadays with the production web applications because no one actually leaves comments in the code anymore uh we also have a submit token uh link here which takes us to a ctf dashboard alright so it looks like you typically submit your flags here or the passwords here so let's move on to native one and um just hit latest one and we'll paste in the password here all right so it tells us you can find the parcel for the next level on this page but right clicking has been blocked um so let's see if we can right click so it tells us right clicking has been blocked uh uh no it looks like we can actually right click at the bottom here so it looks like there's a div or a container that we cannot actually right click on but we can do it right over here and we get the password for nato's level two um if we explore the page we can't see anything anything interesting at all so let's just head on over to the next level uh so far this is quite simple but i guess it starts off that way i'm not really sure with bandit it's sort of tapered off at the end it got quite challenging but um anyway so nate is too uh it tells us that there's nothing on this page um let's see if we can view the source so it tells us again it gives us the standard uh header here then it tells us that the stuff in the head has nothing to do with the level quite interesting uh i don't think i'll take them that seriously because it looks like they have some interesting information here so we get the it tells us there's nothing on this page and it gives us an img here on image which i can't actually see here that's interesting um and the image is a pixel.png so if we click on it it just displays a pixel a single pixel which is why we can't actually see it here on the web page uh it also looks like this is under a directory called file so let's see if we can actually access this directory or perform some directory traversal so png yeah that's the png file let's see if we can access this directory and indeed we can so we get a users.txt file but the other thing we can see is we're running apache 2.4.10 on a debian server so yeah that that's pretty standard information if we go to the parent directory that takes us back to the home page so i'll go back if we go to the users.txt file uh this gives us uh users for for some other it gives us passwords for some other users and also deposit for natives level three so i'll keep this webpage open in case we need it and let me just back out a little bit here and we'll open up nato's level three and level three and we'll just enter the password all right so this tells us there's nothing on this page so again let's view the source let's also check uh let's also check whether we can uh yeah that's fine all right so this tells us the same thing uh and for the content we have a comment here telling us that no more information leaks not even google will find it so uh that looks like a hint to actually uh take a look at the robots.txt file which will actually show us what files and directories are disallowed and immediately we get a directory called secret so let's try and access this directory [Applause] let's see what files or directories we have in here so it looks like we have a users.txt file so let's click on that and that gives us the password for latest four so yeah this is this is fairly simple um um so let's go to nato's four and um we'll click on enter and uh yeah we want to just get rid of this secret directory because we are dealing with a new level now oops sorry about that guys uh looks like i open this up in a in a different tab here can i actually just drag this back on top yeah there we are so we'll drag this back and this tells us access disallowed you're visiting from quotation marks looks like it can actually be a very variable there while authorized users should only come from http natives5.nativeslabs.overview.org if we refresh the page we see that it yeah it tells us that you're visiting from natives4.labs.org.org while authorized user should only come from nato's five uh so i think yeah this we did i think i know what we're supposed to do here so it looks like this is just a simple case of just changing the referrer from nato's we with the request the get request from nato's four to native five and hopefully that gives us a different response let's just check the source here because i don't want to miss anything so it looks like it doesn't give us anything else apart from the standard stuff in the header and the javascript variable here um so i think it's time we actually use our proxy uh we're gonna be using zap and for some reason i actually forgot to install the foxy proxy plugin so foxy proxy um we're on mozilla firefox here so we'll just get the standard edition and i'll just wait for this to load up i'll add this to firefox i should have actually done this before recording the video but in any case yeah there we are so we'll just go into options and i'll add a new proxy here we'll call it wasp zap and i'll just give it a nice blue color that represents its actual logo and well this is going to be localhost so 1.6127.0.0.1 and the port is going to be port 8080 and i'm going to save and yeah so we have that active um by the way i think i'd installed a custom certificate here let me just see if i have it installed because uh i'll actually show you how to do this so if you want you you want to install the ca certificate or the certificate authority for us zap which i believe i already did because i've been using it quite a bit so i'm just going to delete that and just hit ok so i'll start up os app here so open new window and i believe it's called zap proxy i'll also make a video showing you how to install it on the various linux distributions if you guys want to see that so i'll just hit enter that's gonna start up the zap proxy for us here i'm just gonna hit start um let me just close this up so uh if you want to actually uh generate a certificate or a certificate authority you want to go into tools and uh options you're looking for another client certificate we're looking for dynamic ssl certificates and you can generate or you can import one and then you all you need to do is click on save and you can save it to a particular directory and then all you need to do is import it with firefox so what we'll do now is let's actually see whether we can intercept this right now so i'm just going to click on osap here and i do not i don't want to i do not want to set a break on any requests i just want to see how the data or how the requests are being sent so advanced uh accept the risk and continue uh for some reason it keeps on telling us uh view certificate uh all right so yeah i think i'm oh yeah i forgot to reinstall it sorry about that so i'll just import and we'll import the os zap certificates all trust the certificate and just hit ok and let's try that one more time now so i'll just disable the proxy one more time just turn off and uh we will sort of get rid of this here i'll just hit http and we'll reload this with osp zap so i'm just going to reload and it asks us for the password which i believe uh nato's for did i even save the password latest four let's see if i have it on my clipboard thank god i have it so all right so i sent the request so let's see how that was actually sent so we have a 200 code a response code so let's click on that uh so osap is very very simple to use so you can see right over here we have the actual request the get request we can see that we have the referrer which we want to change we also have a cookie and an authorization the key thing or the the interesting thing is if we take a look at the unauthorized one uh we don't have the we don't have the authorization flag here or the parameter and i don't see any username or password being parsed so it looks like this base64 code is holding some data so let's actually see what data it's holding so if we go with let's just copy that and we want to decode this so i'm just going to click on decode and i'll paste that in here and yes so you can see it's base64 and once we decode it we can see we have the password uh and it's nature's four so the user and the password so natives four and the password for natives four so that's interesting that will help us uh navigate this a little bit better so what i'm going to do is we've already authenticated now that's good um so what i want to do is i just want to uh i'm just going to set i'm just going to set a break on all the requests because we want to intercept it so i'm just going to reload this and we're going to go back into the zap proxy here and we want to take a look at the latest one here so if i just click submit to the next breakpoint here let's see if that is actually reloaded all right so there we go that reloaded so i'm just going to set this one more time and i'm going to reload that again and uh we want to take a look at this one right over here if we change the referrer to nato's five sorry we want to send this to the request editor so we want to change the referrer to nato's five and we just hit send uh yeah we get the password for nato's five which was yeah that that that was pretty quick so uh it looks like uh so if we just uh let's just close this up here and uh i'm gonna go back into zap uh by the way did i get the response here so again we simply if we change that and let's just unset that so that should let's make sure we also for the next packet and let's refresh that one more time because i didn't actually copy the password here but any case uh i'm just gonna break i'm just gonna set that there and we will actually click on this here and we want to send this to the request editor and we're going to change that to latest five and hit send and we get deposit for nato's five so i'm just going to copy that and we'll close this up and what i'll do is i'll just i'll just unset and i will make sure that i have uh i've actually submitted and continue to the next breakpoint so this you can see it's quite similar to burp suite so what i'll do now is i'll just disable the foxy proxy right over here and we'll stop proxing through as zap and i'll just reload this to nato's five and so i'll say nato's five and we will hit okay and hit enter and you can see it tells us access disallowed you're not logged in all right so i think we're now at native level five so this looks like it's dealing with an authentication vulnerability so uh that's gonna be it for this video i want to sort these videos out based on the vulnerabilities that they're covering and i feel we've gone long enough in this video i want to keep them nice and short so that we can cover things more effectively so that's going to be for this video and i'll be seeing you in the next video you