OverTheWire - Natas - Level 6

Natas teaches the basics of server-side web-security.

each level of natas consists of its own website located at http://natasX.natas.labs.overthewire.org, where X is the level number. This is no SSH logging. To access a level, enter the username for that level (e.g. natas0 for level 0) and its password.

Each level has access to the password of the next level. Your job is to somehow obtain that next password and level up. All passwords are also stored in /etc/natas_webpass/. E.g. the password for natas5 is stored in the file /etc/natas_webpass/natas5 and only readable by natas4 and natas5.

---

After logging in to natas6 we'll see an input box looking for the secret and a link to view the source code.

When you click the source code you'll get the server side PHP that should look something like this:

include "includes/secret.inc";

if(array_key_exists("submit", $_POST)) {
    if($secret == $_POST['secret']) {
        print "Access granted. The password for natas7 is 'censored'";
    } else {
        print "Wrong secret";
    }
}

This checks the post variables passed in by the form and compares them to the variable $secret. But where is $secret defined? Take a look at /includes/secret.inc. Take this secret, put it in the input box back on the initial screen and submit it to have the password for natas7 shown.