Natas0
Natas Level 0 — sign in to the first website and find a password the page does not show you but still sends to your browser.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
Username: natas0
Password: natas0
URL: http://natas0.natas.labs.overthewire.org
Study guide
Level map: sign in as natas0 and find the password for natas1.
What this level teaches
That a web page is more than what you see on screen. Your browser receives HTML, CSS and JavaScript, and everything it receives is visible to you.
Key ideas
- HTTP Basic authentication. The username and password in the level’s description are sent with every request in a header; the browser pop-up is just a form for that header.
- The page source. The browser renders the HTML it was sent but you can read the raw text with “View Source” or the developer tools.
- Client-side is public. Anything sent to the browser, including HTML comments, can be read by the user.
How to approach it
- Log in with the credentials on this page.
- Read the message on the page, then look at what is behind it.
How developers prevent it
Never put secrets, credentials or internal notes in HTML, comments or JavaScript. Treat everything in the response as public.