Прыгай!

Platform: bug-makers | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: 404_page_inspection, flag_extraction_from_frontend_code, js_bundle_analysis

Summary

Task: find a flag hidden on the 404 error page of a website, which contains a Chrome dino-style jumping game. Solution: analyze the Nuxt.js JavaScript bundle to extract flag characters from the game's collectible items array and reconstruct the flag using CSS ordering rules.

Прыгай! (Jump!) — Bug Makers CTF

Description

Соберите флаг на несуществующей странице сайта: https://bug-makers.ru

English summary: Collect the flag on a non-existent page of the website. The task name "Прыгай!" means "Jump!" — hinting at a jumping game hidden on the 404 page.

Analysis

The challenge explicitly tells us to look at a "non-existent page" — this is a direct hint to examine the 404 error page of the website.

Navigating to any non-existent URL (e.g., https://bug-makers.ru/nonexistent-page) returns a custom 404 page with:

• Title: "БАГодельня – Ошибка 404"
• Message: "поиграй пока тут..." ("play here for now...")
• An interactive Chrome dino-style jumping game called "bugozavr" (a play on "bug" + "dinosaur") ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The game is built with HTML5 Canvas as a Vue.js component (Bugozavr.client) within the Nuxt.js frontend framework. The player controls a character that jumps over obstacles and collects items — each collectible item is an SVG image representing a single character of the flag.

Solution

Step 1: Access the 404 page

Navigate to any non-existent URL on the site:

https://bug-makers.ru/this-page-does-not-exist

The server returns a custom 404 page with the jumping game.

Step 2: Locate the JavaScript bundle

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The Nuxt.js application bundles all frontend code into JS files. The game component is in the main bundle at /_nuxt/DQfIVtJK.js.

Step 3: Extract flag characters from the game code

Inside the Bugozavr.client component, there is an array h that defines the collectible items. Each item has an image property pointing to an SVG file named after a single character:

 javascript read-only • copy allowed Copy
// Collectible items array (simplified)
h = [
  { image: "/static/bugozavr/b.svg" },
  { image: "/static/bugozavr/u.svg" },
  { image: "/static/bugozavr/g.svg" },
  { image: "/static/bugozavr/c.svg" },
  { image: "/static/bugozavr/t.svg" },
  { image: "/static/bugozavr/f.svg" },
  { image: "/static/bugozavr/4.svg" },
  { image: "/static/bugozavr/0.svg" },
  { image: "/static/bugozavr/4.svg" },
  { image: "/static/bugozavr/f.svg" },
  { image: "/static/bugozavr/l.svg" },
  { image: "/static/bugozavr/a.svg" },
  { image: "/static/bugozavr/g.svg" },
  { image: "/static/bugozavr/n.svg" },
  { image: "/static/bugozavr/o.svg" },
  { image: "/static/bugozavr/t.svg" },
  { image: "/static/bugozavr/f.svg" },
  { image: "/static/bugozavr/o.svg" },
  { image: "/static/bugozavr/u.svg" },
  { image: "/static/bugozavr/n.svg" },
  { image: "/static/bugozavr/d.svg" }
]

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reading the characters in order: b u g c t f 4 0 4 f l a g n o t f o u n d

Step 4: Reconstruct the flag with CSS ordering

The CSS uses nth-child selectors with order properties on a .bugozavr__flag-box container to visually group the characters with braces and underscore dividers:

Step 5: Assemble the flag

bugctf{REDACTED}

The flag itself is a meta-joke: "404 flag not found" — the flag is literally on the 404 page, and its content references the HTTP 404 status code. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍