← Back to Writeups
CUSTOMEasyOSINT
Bookmark

Бесславные БАГоделы

XESXOR9/10/20262 min read
#osint#custom#easy#base64_decoding#html_source_inspection#url_parameter_analysis#linux

Бесславные БАГоделы

Platform: bug-makers | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: base64_decoding, html_source_inspection, url_parameter_analysis

Summary

Task: find a flag hidden in a Telegram news post. Solution: inspect HTML source of the post to find a base64-encoded flag appended as a query parameter to one of the source links.

Бесславные БАГоделы — Bug Makers CTF

Description

— Вы укрываете у себя в тг-канале флаг, ведь так? — Да — Вы прячете его в новостном посте. Верно? — Да — Покажите мне, где он прячется — https://t.me/bug_makers/195

English summary: A dialogue styled after the movie "Inglourious Basterds" confirms that a flag is hidden somewhere in a Telegram news post at https://t.me/bug_makers/195. The task is to find it.

The title "Бесславные БАГоделы" is a wordplay on "Бесславные ублюдки" (the Russian title of "Inglourious Basterds") combined with "БАГ" (bug) — referencing the bug_makers CTF platform. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The linked Telegram post is "Новостной дайджест #6" (News Digest #6), containing three cybersecurity news stories:

  1. FIA data breach — vulnerability on the FIA website exposing F1 driver personal data (passports, resumes, racing licenses)
  2. Poker fraud via Deckmate 2 — USB vulnerability in an automatic card shuffler allowing cheating
  3. OpenAI Atlas browser vulnerabilities — security issues in OpenAI's browser

When viewed normally in Telegram, the post looks completely ordinary — three news stories, each ending with an "Источник" (Source) hyperlink to the original article. No visible anomalies, no zero-width characters, no image steganography. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The key insight is that Telegram's rendered view hides the full URL behind link text. The actual URLs are only visible by inspecting the HTML source or hovering over the links.

Solution

Step 1: Retrieve the post HTML

Access the web-embeddable version of the Telegram post to inspect the raw HTML:

https://t.me/s/bug_makers/195

Step 2: Examine all hyperlinks

The post contains three "Источник" (Source) links. Inspecting each one:

  1. FIA story → https://www.cpomagazine.com/cyber-security/fia-data-breach-exposes-sensitive-personal-information-of-f1-drivers-including-max-verstappens-passport/ — clean URL
  2. Poker story → https://www.securitylab.ru/news/565082.php?f=QnVnQ1RGe3cwd195MHVfZjB1bmRfMXR9 — suspicious ?f= parameter!
  3. OpenAI story → normal URL ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The second link has an anomalous query parameter ?f= appended to an otherwise legitimate SecurityLab article URL. The parameter value QnVnQ1RGe3cwd195MHVfZjB1bmRfMXR9 looks like base64.

Step 3: Decode the base64 string

 bash 
echo 'QnVnQ1RGe3cwd195MHVfZjB1bmRfMXR9' | base64 -d
# Output: BugCTF{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍