> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/overthewire/natas/level-3-level-4.md).

# Level 3 - Level 4

```
Username: natas4
Password: tKOcJIbzM4lTs8hbCmzn5Zr4434fGZQm
URL:      http://natas4.natas.labs.overthewire.org
```

This time the target website stated that we have to come from [http://natas5.natas.labs.overthewire.org](http://natas5.natas.labs.overthewire.org/) to access the content of the page.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FrvYm4L1QDqtLlnKcSjgM%2Fimage.png?alt=media&amp;token=3c8e469d-1435-4ba2-b9cd-f3421d2ab798" alt=""><figcaption></figcaption></figure>

So I intercepted the request using burpsuite and modified the [Referer URL](https://support.google.com/google-ads/answer/2382957?hl=en#:~:text=The%20address%20of%20the%20webpage,your%20site%20using%20a%20link.) from [http://natas4.natas.labs.overthewire.org](http://natas4.natas.labs.overthewire.org/) to [http://natas5.natas.labs.overthewire.org](http://natas5.natas.labs.overthewire.org/) and then sent the request and got the password for the next level in the response.

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2FMIJSxeYyGzPysi8WtgVv%2Fimage.png?alt=media&amp;token=f8c13266-1c74-476c-9cba-0bb3366899fa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1858660820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrGZ5yoqZSj85T6vq2w3c%2Fuploads%2F3XkkaB4zKloZMxdYts1a%2Fimage.png?alt=media&amp;token=b661dd73-62fe-477b-8aa0-91afb589e49c" alt=""><figcaption></figcaption></figure>