/etc/natas_webpass/natas#

natas2:ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi

Saw image at /files/, go to to /files, found users.txt

natas3:sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14

Source says "not Google" → robots.txt

/s3cr3t/ → users.txt

natas4:Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ

change html referer using Tamper Data extension for FF

natas5:iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq

not logged in

no /login, /admin

check cookies, value loggedin=0, change to 1

natas6:aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1

source code mentions includes/secret.inc, visit that, ?$secret = "FOEIUWGHFEEUHOFUOIU";?

natas7:7z3hEENjQtflzgnT29q7wAvMNfZdh0i9

source code has hint: password for webuser natas8 is in /etc/natas_webpass/natas8

url style is http://natas7.natas.labs.overthewire.org/index.php?page=home

http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8

natas8:DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe