SubFlag

Platform: bug-makers | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: dns_txt_record_extraction, passive_subdomain_discovery, subdomain_bruteforce

Summary

Task: find a subdomain of bug-makers.ru that hides a flag. Solution: enumerate subdomains via HackerTarget API, find subdomain-for-the-task.bug-makers.ru, extract the flag from its DNS TXT record.

SubFlag — bug-makers CTF

Description

Один из поддоменов bug-makers.ru скрывает флаг, найдите поддомен и сам флаг.

English summary: One of the subdomains of bug-makers.ru hides a flag. Find the subdomain and the flag itself.

Analysis

The challenge is a classic OSINT/DNS reconnaissance task. We need to:

1. Enumerate subdomains of bug-makers.ru
2. Find the one that "hides" the flag
3. Extract the flag from that subdomain

The key insight is that the flag is not in the web content served by the subdomain — it's stored in the DNS TXT record itself. The subdomain's web page acts as a breadcrumb confirming you found the right target, while the actual flag requires querying DNS records. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Initial DNS Reconnaissance

Started by querying basic DNS records for the apex domain:

 bash read-only • copy allowed Copy
dig +short bug-makers.ru A
# 31.129.109.181

dig +short bug-makers.ru NS
# ns1.beget.ru, ns2.beget.ru, ns1.beget.pro, ns2.beget.pro, ns1.beget.com, ns2.beget.com

dig +short bug-makers.ru TXT
# google-site-verification, yandex-verification, SPF records (nothing useful)

Attempted AXFR zone transfer on nameservers — both refused:

 bash read-only • copy allowed Copy
dig @ns1.beget.com bug-makers.ru AXFR
# Transfer failed.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Subdomain Brute-Force

Ran DNS A record lookups for common subdomain names. Found several live subdomains:

No wildcard DNS was configured (random subdomains returned NXDOMAIN).

Step 3: Passive Subdomain Discovery via HackerTarget API

Used the HackerTarget hostsearch API for passive subdomain enumeration:

 bash read-only • copy allowed Copy
curl -s "https://api.hackertarget.com/hostsearch/?q=bug-makers.ru"

This revealed many additional subdomains, including the critical one:

subdomain-for-the-task.bug-makers.ru,31.207.77.216

Also found: 2025.bug-makers.ru, alex.bug-makers.ru, aperi.bug-makers.ru, back-test.bug-makers.ru, front-test.bug-makers.ru, pixie.bug-makers.ru, and various *.t1.bug-makers.ru task subdomains. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Visiting the Target Subdomain

Accessed the discovered subdomain:

 bash read-only • copy allowed Copy
curl -s https://subdomain-for-the-task.bug-makers.ru

The HTML page contained:

• "Вы на верном пути!" (You're on the right track!)
• "Флаг скрывает именно этот поддомен" (This subdomain hides the flag)

This confirmed we found the right subdomain, but the flag was not in the HTML source. The hint "this subdomain hides the flag" suggested looking at DNS records for the subdomain itself.

Step 5: DNS TXT Record Extraction

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Queried the TXT DNS record for the specific subdomain:

 bash read-only • copy allowed Copy
dig +short subdomain-for-the-task.bug-makers.ru TXT

Result:

"Flag: BugCTF{REDACTED}"

The flag was stored directly in the DNS TXT record of the subdomain. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍