Jenkins

Jenkins is the most widely used open-source CI/CD automation server. It typically runs on TCP port 8080 for its web interface. Nmap identifies it as http on this port, with Jenkins identifiable through its X-Jenkins response header and login page.

Jenkins is a critical target because it has access to source code repositories, build artifacts, deployment credentials, and production infrastructure. Misconfigured Jenkins instances frequently allow unauthenticated access to the dashboard, build logs, and, most dangerously, the Script Console (/script), which provides Groovy script execution on the server. Even without admin access, exposed build logs often contain credentials, API tokens, and internal URLs. Jenkins credentials are stored encrypted, but the master key is on disk and can decrypt them all.

Enumeration begins with checking for unauthenticated access to the dashboard and Script Console. The /api/json endpoint reveals jobs, builds, and server configuration. Testing for default credentials, user enumeration via the signup page or /asynchPeople/, and checking the Jenkins version against known CVEs (such as CVE-2024-23897 for arbitrary file read) are essential. When code execution is achieved, extracting stored credentials from credentials.xml and secrets/ is the standard next step.