Natas Level 3 -> Level 4
Skills - BurpSuite or proxy, HTTP Headers
Last updated
Was this helpful?
Skills - BurpSuite or proxy, HTTP Headers
Last updated
Was this helpful?
Modified Request - We modify referrer as shown below. Also, modify /index.php in the GET request as that will likely throw as error too.
Once you forward the modified request, you will land to homepage and get the flag.
Password - iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
The access is disallowed if you directly try visit the site. It says to come from . If you directly visit with "natas4" creds, it says unauthorized.
Viewing page source will reveal nothing. We need to think of accessing target URL by visiting and somehow re-directing to target URL.
For this, we need to start using proxy (I have used BurpSuite community edition) -
Original request when clicked "Refresh Page" - We see "Referer" field being used and it comes from target URL itself, which is quite normal. But looking at the homepage., it says access is allowed to homepage is only through . Let's change Referer to ""
