OverTheWire Natas Level 15

3 minute read Nov 14, 2012 Comments
Up until now, none of the OverTheWire Natas challenges really gave me that much of an issue. This one however, took me a couple hours to complete. Level 15 is a fun blind sql-injection vulnerability. It starts out with a username check dialog, which pretty much only gives you a binary value as to if a username exists or not. I looked at the source code, and couldn’t see any way to inject some SQL to get it to retrieve the password for me.

OverTheWire Natas Level 14

2 minute read Nov 13, 2012 Comments
The next level of the OverTheWire Natas wargame is Level 14, which introduces SQL Injection, a very popular subject as of late. The level starts out with a login dialog. The source code is fairly straight forward. It’s doing a basic authentication query. It however, does have a handy “debug” flag, that if set, will print the query used to the screen. <html> <head><link rel="stylesheet" type="text/css" href="http://www.overthewire.org/wargames/natas/level.css"></head> <body> <h1>natas14</h1> <div id="content"> <?

OverTheWire Natas Level 13

3 minute read Nov 12, 2012 Comments
Level 13 of OverTheWire’s Natas wargame is extremely similar to Level 12. The only difference now, is that it’s validating that the file is in fact an image. This however is flawed, as exif data can be faked. It starts out with a similar upload prompt as last time. The source code is super similar to last time. <html> <head><link rel="stylesheet" type="text/css" href="http://www.overthewire.org/wargames/natas/level.css"></head> <body> <h1>natas13</h1> <div id="content"> For security reasons, we now only accept image files!

OverTheWire Natas Level 12

3 minute read Nov 11, 2012 Comments
The next level to attack in the OverTheWire Natas wargame, is Level 12, which is more “real-world” as well, since developers often forget to limit file extensions. It starts out giving you the option to upload a <1KB file to the server. As with any other challenge, I viewed the source, to analyze it. <html> <head><link rel="stylesheet" type="text/css" href="http://www.overthewire.org/wargames/natas/level.css"></head> <body> <h1>natas12</h1> <div id="content"> <? function genRandomString() { $length = 10; $characters = "0123456789abcdefghijklmnopqrstuvwxyz"; $string = ""; for ($p = 0; $p < $length; $p++) { $string .

OverTheWire Natas Level 11

3 minute read Nov 10, 2012 Comments
Level 11 of the OverTheWire Natas wargames is a good one. It wasn’t one that could instantly be solved either. It involved programming, encryption, and HTTP. All fun! It started with a dialog to set the background color. When you click the “Set Color” button, it sets a cookie in your browser. But as the dialog says, the cookie is protected. I looked at the source code, as I always do.

OverTheWire Natas Level 10

1 minute read Nov 9, 2012 Comments
On to Level 10 of the OverTheWire Natas wargame! This level is extremely similar to level 9, except that now they are implementing a basic filtering, to prevent you from entering certain characters that could cause changes in the execution of the program. However, their filter is flawed. It starts out just like the last level, with a search dialog. Again, as always, I review the code since it’s available.

OverTheWire Natas Level 9

1 minute read Nov 8, 2012 Comments
The next level of OverTheWire’s Nata challenge is Level 9. This is a command injection vulnerability. Initially, you are given a search box. Just like in previous levels, I looked at the available source code. You can see the vulnerability is that the user input is not sanitized. Due to this, you can inject code into the “grep” command it is running to do the search. I simply put in the search box, “; cat /etc/natas_webpass/natas10”, since that is where the password file is located.

OverTheWire Natas Level 8

1 minute read Nov 7, 2012 Comments
Level 8 of the OverTheWires Natas wargame was pretty simple, as a developer, but could prove more difficult if you don’t have similar background. It starts out with a secret password input. Like other levels, I looked at the source code to see what was going on in the background. Based on this code, you can see that it has a stored secret value, that is base64 encoded, then reversed, and then converted to a hex string.

OverTheWire Natas Level 7

1 minute read Nov 6, 2012 Comments
Finally, with level 7 of OverTheWire’s Natas wargame, we start to get to more “real world” vulnerabilities. It’s still very easy, but it’s at least getting better. We start with a single page, that has 2 navigation links. I noted that the URLs had a “page=” parameter. I thought maybe this would be the file it was including. Viewing the source gave a nice reminder of where the password for the next level would be stored.

OverTheWire Natas Level 6

1 minute read Nov 5, 2012 Comments
The 6th level of the OverTheWire Natas wargame starts introducing us to PHP and server configuration issues. It starts out with a secret password prompt. I took a look at the sourcecode, via the link provided. I decided I would try and see if I could request the “secret.inc” file, and it worked perfectly. After I put in the secret value into the input box, it showed me the password for the next level.
Page 1 of 2 1 2