Description

Creators of hit computer game franchises Bloons, Bloons TD and SAS: Zombie Assault for mobile and web. We have offices in Auckland, New Zealand and Dundee, Scotland. We are excited to engage with the security community to help us keep our users safe and our services secure. This is our second Bug Bounty program after a successful campaign in 2021.

Bounties
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 9.4
Exceptional
9.5 - 10.0
Tier 1
150
975
1,875
3,000
3,750
Tier 1
€150 - €3,750
Tier 2
100
650
1,250
2,000
2,500
Tier 2
€100 - €2,500
Tier 3
50
325
625
1,000
1,250
Tier 3
€50 - €1,250
Rules of engagement
Not applicable
Not applicable
max. 10 requests/sec
Not applicable

By participating in this program, you agree to:

  • Respect the Community Code of Conduct
  • Respect the Intigriti Terms and Conditions
  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.

Vulnerability Severity Time to validate
Exceptional 2 Working days
Critical 2 Working days
High 5 Working days
Medium 15 Working days
Low 15 Working days

This remains at the discretion of the Ninja Kiwi Games to award.

Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Ninja Kiwi Games to award.

Domains

analytics.ninjakiwi.com

Tier 1
URL

This domain hosts the API that consumed analytics events from our game clients

api.ninjakiwi.com

Tier 1
URL

This domain hosts the API for our mobile and PC games. Monitoring traffic through one of our game clients is the easiest method to investigate our main API. Most of our applications are available for free on Steam. Please carefully read the in-scope section regarding what sorts of exploits will be considering in-scope for this domain.

builds-auckland.ninja.kiwi

Tier 1
URL

This domain hosts builds of Ninja Kiwi games for iOS devices.

Areas of focus:

  • The ability to download any valid build from this service will be considered a CRITICAL vulnerability.
  • We will reward any enumeration of available game builds with a Medium bounty.

*.nkstatic.com

Tier 2
URL

This domain hosts static content for Ninja Kiwi games and website.

battles.tv

Tier 2
URL

Battles.tv is used to share replays from our Bloons TD Battles game.

data.ninjakiwi.com

Tier 2
URL

This domain hosts our public data API which grants open access to in-game data from our biggest games. For example player profiles, leatherboards and event information is available through this domain.

ninja.kiwi

Tier 2
URL

This domain is used by Ninja Kiwi for our URL shortener service, ie https://ninja.kiwi/intigriti.

ninjakiwi.com

Tier 2
URL

*.ninjakiwi.com

Tier 3
URL

This covers any subdomains of ninjakiwi.com other than sub-domains which are managed by authorized third-party services. For example:

ct.ninjakiwi.com

Tier 3
URL

mynk.ninjakiwi.com

Tier 3
URL

This is a legacy domain which powers our Flash games. Uses Flash AMF.

*.souparea.com

No Bounty
URL

This domain will be considered out of scope unless it can be shown to allow an exploit on one of our Tier 1-3 domains.

In scope

Introduction
We are happy to announce our first bug bounty program on the Intigriti platform! We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed!

Our worst-case scenarios are

  • Extracting secret keys for our cloud infrastructure access (eg AWS keys)
  • Exfiltration of player PII (email address, hashed passwords, etc)
  • Accessing internal administrator functionality for our main API (api.ninjakiwi.com)

Any useful infrastructure information:

  • Our APIs at api.ninjakiwi.com and analytics.ninjakiwi.com are key targets for this program
  • The majority of the in-scope assets are protected by Cloudflare. If you've found a vulnerability which may be exploitable if Cloudflare was bypassed please get in touch. We may accept these issues if they are exploitable after bypassing Cloudflare and are a high enough severity.

Game Data Consistency
Please be aware that we will mark exploits that manipulate a game's server-side state as "informative" or cap at Low severity if the exploits don't lead to account compromise, PII leaks, access escalation, RCE style exploit, etc.

We've included some examples to help explain the types of exploits which we won't accept or will limit to Low:

  • Injecting scores into a leaderboard
  • Changing the state of a game lobby from public to private
  • Increasing or reducing a players bank balance more than the game client would normally allow

Examples of in-scope vulnerabilities:

  • Ability to log into another users account
  • Enumerating email addresses
  • Accessing any PII for users which isn't normally accessible to the game clients
  • Accessing files or services on our servers which aren't normally accessible.

These rules are mostly applicable to api.ninjakiwi.com, analytics.ninjakiwi.com and ct.ninjakiwi.com.

Feedback
Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here:
Program Feedback Link
Please note this form will be checked periodically and should not be used for submission or support queries.

Out of scope

Game Applications

  • All of our game client apps are out of scope. Bugs or security issues reported for the game clients themselves will be marked as out of scope.
  • Game API's are out of scope.
  • Please do not exploit any vulnerability against accounts other than your own.

Domains

  • Any domain that is not listed in the Domains section, is out of scope for this program

Application

  • Vulnerabilities requiring the victim to use a modified game client
  • Exploits which gives an account additional in-game currencies or items, since this does not affect other players
  • Manipulating non-authenticated server-side data (such as some leaderboard scores) unless that manipulation can lead to account compromise
  • Gaining early access to upcoming in-game content or promotional material
  • Wordpress usernames disclosure
  • Pre-Auth Account takeover/OAuth squatting
  • Self-XSS that cannot be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Bypassing rate-limits or the non-existence of rate-limits.
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Tokens leaked to third parties
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing/Version disclosure
  • Not stripping metadata of files
  • Same-site scripting
  • Subdomain takeover without taking over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file
  • Blind SSRF without proven business impact (pingbacks are not sufficient)
  • Disclosed/misconfigured Google Maps API keys
  • Host header injection without proven business impact

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept

Mobile

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
  • API key leakage used for insensitive activities/actions
Severity assessment

This program follows Intigriti's contextual CVSS standard

FAQ

Where can we get credentials for the app?

For the domain api.ninjakiwi.com, you can sign up for a free account from inside any of our recent games. Most of these games are free to play and are available on mobile stores as well as Steam.

For mynk.ninjakiwi.com you can create a free account in our NK Archive application and then launch any of our legacy flash games (Bloons TD 5, etc)

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Last 90 day response times
avg. time first response
< 3 days
avg. time to decide
< 3 days
avg. time to triage
< 3 days
Activity
9/25
Ninja Kiwi Games
accepted a submission
9/24
logo
created a submission
9/22
logo
created a submission
9/22
Ninja Kiwi Games
closed a submission
9/21
logo
created a submission
9/11
Ninja Kiwi Games
closed a submission
9/11
Ninja Kiwi Games
closed a submission
9/8
logo
created a submission
9/8
logo
created a submission
9/5
Ninja Kiwi Games
closed a submission