# Level 21 - Level 22

```
Username: natas22
Password: 91awVM9oDiUGm33JdzM7RVLBS8bz9n0s
URL:      http://natas22.natas.labs.overthewire.org
```

## Overview

This time we got an empty page with a link to the source code.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2F4iPWp6SyYrL8kLODZgJI%2Fimage.png?alt=media&#x26;token=be26bb10-d189-4028-8e76-80bc887b2632" alt=""><figcaption></figcaption></figure>

***

## Source Code Analysis

Let's take a look at the source code. The first code block of the application looks out for the URL parameter `revelio` from a GET request and if it exists it checks whether the session contains the key-value pair `admin=1` and if so it sets the header `Location: /`.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FYXolHV3jPryMgQ1GZeSu%2Fimage.png?alt=media&#x26;token=32a27743-ace7-4cd3-915f-689026356cb6" alt=""><figcaption></figcaption></figure>

The second code block of the application looks out for the URL parameter `revelio` from a GET request and if exists it shows the credentials for the next level.

***

## Getting the Password

I tried a GET request in the browser with the URL parameter `revelio`, which responded with a empty page.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FSx8vGBXpgdhx7HHSYl1V%2Fimage.png?alt=media&#x26;token=8515ada7-a47f-4543-9bde-330bfaa69608" alt=""><figcaption></figcaption></figure>

I checked the burp HTTP history to get insights on what happend. You can see that the request got redirected and we got an empty page as a result. But the response for the GET request with the URL parameter `revelio` is recorded in the burp HTTP history, which contains the credentials for the next level.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FlaAK7lM9rBHipbrWkbnM%2Fimage.png?alt=media&#x26;token=1b7b6b90-284f-4e86-a69e-54eebab4a1e0" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-21-level-22.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.