Natas Level 3 -> Level 4

Skills - BurpSuite or proxy, HTTP Headers

Username: natas4
Password: Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ
Target URL:

The access is disallowed if you directly try visit the site. It says to come from If you directly visit with "natas4" creds, it says unauthorized.

Viewing page source will reveal nothing. We need to think of accessing target URL by visiting and somehow re-directing to target URL.

For this, we need to start using proxy (I have used BurpSuite community edition) -

Original request when clicked "Refresh Page" - We see "Referer" field being used and it comes from target URL itself, which is quite normal. But looking at the homepage., it says access is allowed to homepage is only through Let's change Referer to ""

Modified Request - We modify referrer as shown below. Also, modify /index.php in the GET request as that will likely throw as error too.

Once you forward the modified request, you will land to homepage and get the flag.

Password - iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq

Last updated