This one lets you browse through pages with the "page=___" GET parameter.
Looking at the source gives us the hint:
<!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->
What happens if we substitute this filepath in for the "home" or "about" pages?
That does it.