Welcome back. \u00a0In this post we’re going to continue on in the Natas wargame, provided by Over The Wire. \u00a0This is a web-based wargame highlighting web security issues. \u00a0Let’s get started.<\/p>\n
Upon logging into the level2 page with the password we acquired during the previous level, we see a message saying that there is nothing on this page. \u00a0That’s great, but lets see if there is anything of use. \u00a0View source! \u00a0Upon viewing source we can see two links to directory structures. \u00a0One is to the css file for Natas, and looking at the URL we might remember that’s the main URL of natas. \u00a0This means that when we go there, there must exist some sort of index.html file, the default file which is loaded when a directory is accessed. \u00a0Thus, we won’t be able to get a listing of the directory. \u00a0However, if we look at the other link, “files\/pixel.png”, we see that the local files directory is a directory we haven’t looked in yet. \u00a0So, let’s go there and see if we can get a directory listing to find anything interesting. \u00a0Hitting\u00a0http:\/\/natas2.natas.labs.overthewire.org\/files\/<\/a>\u00a0we get a directory listing of two files, pixel.png and users.txt. \u00a0Looking in users.txt we see the password for the next level!<\/p>\n Moral of the story? \u00a0Watch which directories are in a www view-able folder. \u00a0Throw in an index.html if you don’t want a directory listing in a directory, or use something like .htaccess to limit access in specific directories, or turn off directory listing in general!<\/p>\n Upon logging into the level3 web page, we see a message saying nothing is there, again. \u00a0So let’s view source (this should be second nature by now). \u00a0A comment says there are no information leaks, not even to Google. \u00a0What could that mean?<\/p>\n Well, if you know how Google works (at least in the big picture), you might know that they “crawl” through the internet looking for pages so that they can index them and search through them. \u00a0They also know that certain web owners may not want google searching through certain things. \u00a0As such, Google and many other search engines will look for specific files for them which describe what they can search through and what they shouldn’t, on a given webpage. \u00a0This might be what level3’s comment is talking about. \u00a0If this file exists telling Google not to look in certain places, it will give us an idea of the directory structure of this level! \u00a0This file is called robots.txt. \u00a0Let’s look for this file ourselves!<\/p>\n Pointing our browser at robots.txt we see it specifies a directory which shouldn’t be searched. \u00a0However, since this is just a request for search engines to not search it, it still allows for us users to load it up! \u00a0Looking in this directory we see a single users.txt file with the password for the next level. \u00a0Done!<\/p>\n Lesson? \u00a0Robots.txt requests for search engines to not search through directories, it doesn’t disallow them to, nor does it disallow directory listings. \u00a0Robots.txt is a polite request for someone not to do something, it isn’t a security measure!<\/p>\n","protected":false},"excerpt":{"rendered":" Welcome back. \u00a0In this post we’re going to continue on in the Natas wargame, provided by Over The Wire. \u00a0This is a web-based wargame highlighting web security issues. \u00a0Let’s get started. Level 2 Upon logging into the level2 page with … Continue reading Level 3<\/h2>\n