Natas 2 tells us that there’s nothing on the page. After we check the source, we find that’s not exactly true though. There’s a tiny one pixel image, which in itself is not very interesting. However, if we look at the URL (files/pixel.png), that appears much more promising. Checking /files shows there’s an entry called users.txt, which contains several passwords, the relevant one being for user natas3.

<body>
<h1>natas2</h1>
<div id="content">
There is nothing on this page
<img src="files/pixel.png">
</div>
</body>

Directory listing for files

Image description

Passwords:

# username:password
alice:BYNdCesZqW
bob:jw2ueICLvT
charlie:G5vCxkVV3m
natas3:XXXXXXXXXXXXXXXXXXXXXXXX
eve:zo4mJWyNj2
mallory:9urtcpzBmH