> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-9-level-10.md).
# Level 9 - Level 10
```
Username: natas10
Password: D44EcsFkLxPIkAAKLosx8z3hxX1Z4MCE
URL: http://natas10.natas.labs.overthewire.org
```
## Overview
Again an input field with a link to the source code.
***
## Source Code Analysis
This time, the source code logic contains input validation using Regular Expression.
Breaking down the RegExp pattern:
This time also, the input field is vulnerable to command injection, since the input is directly substituted in the command. But this time we have to bypass the input validation.
Grep will return the entire content if we give an empty string ( "" ) as a filter. We can leverage this feature to bypass the validation by using the payload: `"" /etc/natas_webpass/natas11 #`.
If we give the above payload as the input the resultant command on the server would be:
`grep -i "" /etc/natas_webpass/natas11 #`` `~~`dictionary.txt`~~
where:
* `/etc/natas_webpass/natas11` - location of the password file.
* `#` is used to comment out the remaining command ( [PHP Comments](https://www.w3schools.com/php/php_comments.asp) )
Direct link to solution:
