Natas 7

This one lets you browse through pages with the "page=___" GET parameter.

Looking at the source gives us the hint:

 <!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->

What happens if we substitute this filepath in for the "home" or "about" pages?

That does it.