> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-21-level-22.md).

# Level 21 - Level 22

```
Username: natas22
Password: 91awVM9oDiUGm33JdzM7RVLBS8bz9n0s
URL:      http://natas22.natas.labs.overthewire.org
```

## Overview

This time we got an empty page with a link to the source code.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2F4iPWp6SyYrL8kLODZgJI%2Fimage.png?alt=media&amp;token=be26bb10-d189-4028-8e76-80bc887b2632" alt=""><figcaption></figcaption></figure>

***

## Source Code Analysis

Let's take a look at the source code. The first code block of the application looks out for the URL parameter `revelio` from a GET request and if it exists it checks whether the session contains the key-value pair `admin=1` and if so it sets the header `Location: /`.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FYXolHV3jPryMgQ1GZeSu%2Fimage.png?alt=media&amp;token=32a27743-ace7-4cd3-915f-689026356cb6" alt=""><figcaption></figcaption></figure>

The second code block of the application looks out for the URL parameter `revelio` from a GET request and if exists it shows the credentials for the next level.

***

## Getting the Password

I tried a GET request in the browser with the URL parameter `revelio`, which responded with a empty page.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FSx8vGBXpgdhx7HHSYl1V%2Fimage.png?alt=media&amp;token=8515ada7-a47f-4543-9bde-330bfaa69608" alt=""><figcaption></figcaption></figure>

I checked the burp HTTP history to get insights on what happend. You can see that the request got redirected and we got an empty page as a result. But the response for the GET request with the URL parameter `revelio` is recorded in the burp HTTP history, which contains the credentials for the next level.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FlaAK7lM9rBHipbrWkbnM%2Fimage.png?alt=media&amp;token=1b7b6b90-284f-4e86-a69e-54eebab4a1e0" alt=""><figcaption></figcaption></figure>