Zen by Aikido is an embedded security engine for autonomously protecting applications against common web attacks, like shell injection and SQL injection. We do so by hooking into sinks, validating them together with the incoming user input and in case the request is malicious, we block the request. It's similar to a traditional WAF, but with the full context of the called code and the user's input.
Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.
| Vulnerability Severity | Time to validate |
|---|---|
| Exceptional | 2 Working days |
| Critical | 2 Working days |
| High | 5 Working days |
| Medium | 15 Working days |
| Low | 15 Working days |
This remains at the discretion of Aikido Security BV to award.
Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Aikido Security BV to award.
Tier 1 is for vulnerabilities which we potentially introduce via our own firewall component in the user's application.
See Severity Assessment for more information.
Tier 2 is for bypasses in the vulnerability detection of the firewall component, such as a bypass of our SQL injection detection.
See Severity Assessment for more information.
Tier 3 is for any false positives you encounter with our vulnerability detection. For example, cases where we falsely flag a SQL injection, while the user's input is safely encapsulated in the SQL query.
Severity assessments are slightly harder for these cases, see "Severity Assessment" for more information.
We follow Intigriti's contextual CVSS standard.
For bypasses of vulnerability detection, severity is determined on a case-by-case basis. The following table provides a general overview on what to expect for each bypass:
| Bypass | Severity |
|---|---|
| Missing sink | Low - Medium |
| Missing source | Low - Medium |
| NoSQL injection bypass | Medium - Exceptional |
| Path traversal bypass | Medium - High |
| Shell Injection bypass | None - None |
| SQL injection bypass (PostgreSQL, MySQL, SQLite) | Low - Exceptional |
| SQL injection bypass (other dialects) | Low - Medium |
| Server Side Request Forgery | Low - High |
Notes:
| Bypass | Severity |
|---|---|
| Missing sink | Low - Low |
| Missing source | Low - Medium |
| NoSQL injection bypass | Medium - Exceptional |
| Path traversal bypass | Medium - High |
| Shell Injection bypass | None - None |
| SQL injection bypass | None - None |
| Server Side Request Forgery | None - None |
Notes:
Some crucial factors which determine the severity are:
UPDATE SQL query)Bypasses which only work on Windows or macOS environments may be lower in severity, since web services are not commonly deployed on those.
We're also interested in cases where we falsely block requests from the user, while the user input is safely encapsulated. We've made the bounties simple on purpose for those cases, so you are aware what to expect.
Issues in this Tier will be awarded on a case-by-case basis and depends mostly on:
SELECT, the award will be on the higher end, since such queries may be executed on almost every page you visit as an user).All tiers have the same scope. There is a difference in bounties based on the following:
See https://github.com/AikidoSec/firewall-node/tree/main?tab=readme-ov-file#installation, and follow the instructions for Express.js based apps.
Ensure you set the environment variable AIKIDO_BLOCKING to true when launching your app. This ensures that you get immediate feedback during testing if your attack is blocked.
We recommend you to install firewall-node with any of the Express.js sample apps or with a DVWA like NodeGoat.
You can install firewall-python directly from PyPi. Ensure you set the environment variable AIKIDO_BLOCKING to true when launching your app. Setting AIKIDO_DEBUG to true may be useful as well.
You can use one of the sample apps as starting point: https://github.com/AikidoSec/firewall-python/tree/main/sample-apps. The Dockerfile contains instructions to build aikido_firewall, so you don't have to do it yourself.
No, you don't. Zen can be used without an Aikido account. An account is only needed when you want to report issues to your Aikido dashboard, but any reporting functionality is not in scope for the time being.
We are considering it for future iterations, but for now, we recommend you to install Firewall with a project like OWASP NodeGoat. This would also allow you to use the debugger, which could help with understanding and testing the detection logic.
Beyond NodeGoat, you could also use some of our sample apps: https://github.com/AikidoSec/firewall-node/tree/main/sample-apps (Node.js) or https://github.com/AikidoSec/firewall-python/tree/main/sample-apps (Python). As an alternative, you can also write some vulnerabilities yourself.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.