Natas 8 - Dudji's Docs

Overview

Field	Value
URL	`http://natas8.natas.labs.overthewire.org`
Username	`natas8`
Password	`xcoXLmzMkoIP9D7hlgPlh9XD7OgLAe5Q`

Another “Input secret” form. The “View sourcecode” link reveals the PHP — including the encoded secret and the function used to encode it.

Hints

Hint 1 — Read the encoding function

The source shows $encodedSecret (the target value) and the encodeSecret() function that transforms input before comparison. Read the function carefully — what three operations does it apply, and in what order?

function encodeSecret($secret) {
    return bin2hex(strrev(base64_encode($secret)));
}

Hint 2 — Reverse the chain

The encoding order is: base64_encode → strrev → bin2hex. To recover the original secret, apply the inverse operations in reverse order:

Hex decode the stored value
Reverse the resulting string
Base64 decode

A tool like CyberChef lets you chain these operations visually.

Solution

Full walkthrough

Start with the encoded secret

3d3d516343746d4d6d6c315669563362

Step 1 — Hex decode

Decode the hex string:

==QcCtmMml1ViV3b

The == at the start is a giveaway that this is a reversed Base64 string (padding normally appears at the end).

Step 2 — Reverse the string

Reverse ==QcCtmMml1ViV3b:

b3ViV1lmMmtCcQ==

Step 3 — Base64 decode

Decode b3ViV1lmMmtCcQ==:

oubWYf2kBq

This is the secret.

Submit

Enter oubWYf2kBq in the form and submit.

With curl

# POST the decoded secret directly to the form
curl -s -u natas8:xcoXLmzMkoIP9D7hlgPlh9XD7OgLAe5Q \
  -X POST -d "secret=oubWYf2kBq&submit=1" \
  http://natas8.natas.labs.overthewire.org/ \
  | grep -i password

Password

natas9: ZE1ck82lmdGIoErlhQgWND6j2Wzz6b6t

​Overview

​Hints

​Solution

​With curl

​Password

Overview

Hints

Solution

With curl

Password