Post cover image
Photo by Immo Wegmann on Unsplash

July 19, 2026

The Secret Was Just One Folder Away

OverTheWire Natas: Level 6 → Level 7

By Previous-Will0071

3 min read

the level that taught me to read before I do anything.

Level 6 → Level 7: The Solve

THE SETUP

Challenge - OverTheWire :: Natas
Category - Web Security (Server-Side)
Level 6 → 7
URL http://natas6.natas.labs.overthewire.org
Credentials natas6 / 7mhjtShJAcld2NYbKHEadnhEwRn2P8VT

### Your browser is your terminal. And it is hiding the Secret.
None

Logged in using the natas6 password. Unlike other levels, this page had a single input box labelled "Input secret", a Submit button, and helpfully (or so I was guessing) a View sourcecode link. Clicked the link to find a clue.

THE HINT

Here's what the source handed me:

None 
<?
include "includes/secret.inc";

    if(array_key_exists("submit", $_POST)) {
        if($secret == $_POST['secret']) {
        print "Access granted. The password for natas7 is <censored>";
    } else {
        print "Wrong secret";
    }
    }
?>

Stared at that input box and my brain immediately went: injection. Thinking it needed a crafted payload that tricks the comparison. Big sighhh… Spent a minute trying to think of what to inject… wait actually let me re-read the code.

And the code is honest with you. It's just:

if($secret == $_POST['secret'])

So… There's no database. No eval. Nothing to inject into. It's a plain string comparison, it checks whatever I type against a variable called '$secret'. So the puzzle was never "what do I inject" It was where does '$secret' even come from?

Look at it carefully, it comes from the line:

include "includes/secret.inc";

The server knows the value. I don't.

THE APPROACH

The same pattern from Level 2 → 3 and Level 3 → 4 — came flooding back. In 2 → 3 browsed a directory and read users.txt. In 3 → 4, robots.txt pointed at a hidden folder. Same muscle memory here! The source code literally handed a file path… sitting on the server.

First attempt (and facepalm): Grabbed secret.inc and tacked it onto the base URL, thinking yay!!! got it:

http://natas6.natas.labs.overthewire.org/secret.inc

But… Nothing. Blank. Disappointed. Even tried pasting the path into the input box thinking maybe the form would fetch it (it didn't — I understood later that box only compares text, it doesn't open files).

None

Then re-read the include line slowly/carefully:

include "includes/secret.inc";

includes/ . Dropped the folder part(that was the issue). The file doesn't live at the root — it's tucked inside an includes directory. So the real path is:

http://natas6.natas.labs.overthewire.org/includes/secret.inc
None

Anddd…. There you go!!! The page coughed up the secret exactly like the source code said it would. Copied it, dropped it into the Input secret box, hit Submit.

None 
Password Found (Natas7)
B1szg95UcTnrzwnF3i3TzYHlyYh8iBV0
found in: includes/secret.inc · method: Source code disclosure
tool: Browser (direct URL request) · Retrieved: $secret → Input secret field

WHAT I ACTUALLY LEARNED

The big lesson wasn't technical — it was about reading things clearly. I nearly went down an injection rabbit hole for a level that had zero injection in it. The code was telling me plainly: "I compare your input to a value stored in another file." My job was just to go read that other file.

KEY TAKEAWAYS

  • Read the code before you reach for a technique. I assumed "input box = injection." Wrong. The comparison was "a plain '=='" against a known-if-you-look-for-it value.
  • include** / require paths are a disclosure goldmine.** They point straight at server-side files that are often still reachable over HTTP.
  • Secrets in web-served files aren't secret. includes/secret.inc was one direct request away from the whole world.
  • Copy the full path. Missing the includes/ folder cost me my first two attempts.
  • The input field only does what the code says it does. Pasting a file path into it was never going to fetch anything — that box just runs one string comparison.

Level 6 → Level 7 shows that a secret is only as safe as the file storing it — and a web-served file is barely storing it at all. See you at Level 7 → Level 8.