> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-8-level-9.md).
# Level 8 - Level 9
```
Username: natas9
Password: Sda6t0vkOPkM8YeOZkAGVhFoaplvlJFd
URL: http://natas9.natas.labs.overthewire.org
```
This time also an input field with a link to the source code.
On checking the source code, input keyword/string that we give is directly supplied as a parameter to the grep command, which looks out for matching strings in the `dictionary.txt` file and returns the output.
This logic is vulnerable to [Command Injection](https://owasp.org/www-community/attacks/Command_Injection#:~:text=Command%20injection%20is%20an%20attack,.\)%20to%20a%20system%20shell.), since the input is directly substituted in the command and no input sanitization is performed.
So, I tried to get the password for the next level by using the following input value:
`; cat /etc/natas_webpass/natas10 ;`
Direct link to the solution:
