OGо какая картинка

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: user_agent_spoofing, og_meta_tag_analysis, social_media_bot_enumeration, multi_part_flag_assembly

Summary

Walkthrough of the CUSTOM Web OGо какая картинка. Task: Express.js server serves different OG preview images depending on User-Agent header. Solution: spoof Telegram, VK, and Odnoklassniki bot User-Agents to retrieve three flag fragments from platfor

Description

Соберите 3 части картинки воедино и получите флаг. Друзья могут помочь

English summary: Collect 3 parts of a picture together and get the flag. Friends can help. The challenge is hosted at https://ogo-image.t1.bug-makers.ru.

Analysis

The challenge title "OGо какая картинка" is a clever wordplay:

• "OG" refers to the Open Graph protocol — the standard used by social media platforms to generate link previews (title, description, image)
• "Ого" is a Russian exclamation meaning "Oh!" or "Wow!"
• Combined: "OG — what a picture!" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The hint "Друзья могут помочь" (Friends can help) points to sharing the link on social media platforms, where their crawler bots fetch OG meta tags to generate link previews.

Initial reconnaissance

Visiting the URL in a browser shows a simple HTML page with an anime background image (bg.jpg) and standard Open Graph meta tags:

 html read-only • copy allowed Copy
<meta property="og:image" content="http://ogo-image.t1.bug-makers.ru/default.png">

Key observations:

• Server: Express.js (revealed by X-Powered-By: Express header)
• Default OG image: default.png — a 1280x630 PNG showing the "БАГодельня" (Bug-makers) logo with no flag content
• The page mentions collecting 3 parts, suggesting 3 different sources ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Core vulnerability: User-Agent-based OG image switching

The server checks the User-Agent header for known social media bot patterns and returns different og:image URLs depending on which platform's bot is requesting the page. When a user shares a link on Telegram, VK, or Odnoklassniki, the platform's crawler fetches the page with its distinctive User-Agent string, and the server serves a platform-specific image containing a flag fragment.

Solution

Step 1: Telegram Bot — Flag Part 1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Requesting the page with the Telegram bot User-Agent:

 bash read-only • copy allowed Copy
curl -s -A "TelegramBot (like TwitterBot)" "https://ogo-image.t1.bug-makers.ru/" | grep og:image

Returns a different OG image URL:

 html read-only • copy allowed Copy
<meta property="og:image" content="http://ogo-image.t1.bug-makers.ru/d594f269bcd2d7a70f2208e65a46aeda.png">

This image contains:

• Flag part 1: BugCTF{OG_im4
• Red text hint: "Вторая в VK" (Second one is in VK)

Step 2: VKontakte Bot — Flag Part 2

Requesting with the VK share bot User-Agent: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s -A "vkShare; +http://vk.com/dev/Share" "https://ogo-image.t1.bug-makers.ru/" | grep og:image

Returns:

 html read-only • copy allowed Copy
<meta property="og:image" content="http://ogo-image.t1.bug-makers.ru/e375409d6a232cab13a3f481170d03ce.png">

This image contains:

• Flag part 2: REDACTED
• Red text hint: "Третья в OK" (Third one is in OK/Odnoklassniki)

Step 3: Odnoklassniki Bot — Flag Part 3

Requesting with the Odnoklassniki bot User-Agent:

 bash read-only • copy allowed Copy
curl -s -A "OdklBot/1.0" "https://ogo-image.t1.bug-makers.ru/" | grep og:image

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Returns:

 html read-only • copy allowed Copy
<meta property="og:image" content="http://ogo-image.t1.bug-makers.ru/49205b1fd349cf5b637d58e1e575ddb3.png">

This image contains:

• Flag part 3: REDACTED}
• Red text: "Победа!" (Victory!)

Step 4: Assembling the Flag

Combining all three parts in order:

The flag in leetspeak reads: "OG image three parts with a bug". ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Complete solve script

 bash read-only • copy allowed Copy
#!/bin/bash
# Solve: OGо какая картинка — bug-makers CTF
URL="https://ogo-image.t1.bug-makers.ru/"

echo "=== Part 1: Telegram ==="
curl -s -A "TelegramBot (like TwitterBot)" "$URL" | grep -oP 'og:image.*?content="\K[^"]*'

echo "=== Part 2: VKontakte ==="
curl -s -A "vkShare; +http://vk.com/dev/Share" "$URL" | grep -oP 'og:image.*?content="\K[^"]*'

echo "=== Part 3: Odnoklassniki ==="
curl -s -A "OdklBot/1.0" "$URL" | grep -oP 'og:image.*?content="\K[^"]*'

echo ""
echo "Download each image and read the flag fragments."
echo "Flag: BugCTF{REDACTED}"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering user_agent_spoofing, og_meta_tag_analysis, social_media_bot_enumeration, multi_part_flag_assembly was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-26 • CUSTOM • OGо какая картинка • Difficulty: Easy