# Jenkins

> Jenkins is a CI/CD automation server. Attackers enumerate exposed dashboards, exploit script consoles for RCE, escalate privileges, move laterally via pipelines, and exfiltrate credentials or secrets

- **URL:** https://hackindex.io/services/jenkins
- **Type:** Service
- **Default ports:** 8080, 8443
- **Tags:** jenkins, ci-cd, web, java, rce, automation
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

Jenkins is the most widely used open-source CI/CD automation server. It typically runs on **TCP port 8080** for its web interface. Nmap identifies it as `http` on this port, with Jenkins identifiable through its `X-Jenkins` response header and login page.

Jenkins is a critical target because it has access to source code repositories, build artifacts, deployment credentials, and production infrastructure. Misconfigured Jenkins instances frequently allow unauthenticated access to the dashboard, build logs, and, most dangerously, the Script Console (`/script`), which provides Groovy script execution on the server. Even without admin access, exposed build logs often contain credentials, API tokens, and internal URLs. Jenkins credentials are stored encrypted, but the master key is on disk and can decrypt them all.

Enumeration begins with checking for unauthenticated access to the dashboard and Script Console. The `/api/json` endpoint reveals jobs, builds, and server configuration. Testing for default credentials, user enumeration via the signup page or `/asynchPeople/`, and checking the Jenkins version against known CVEs (such as CVE-2024-23897 for arbitrary file read) are essential. When code execution is achieved, extracting stored credentials from `credentials.xml` and `secrets/` is the standard next step.

## Phases

- [Enumeration](https://hackindex.io/services/jenkins/enumeration.md): Enumerate Jenkins version, jobs, users, and script console access (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/jenkins/vulnerability-discovery.md): Guides on finding unauth access, RCE paths, and CVE-2024-23897 (1 guides)
- [Exploitation](https://hackindex.io/services/jenkins/exploitation.md): RCE via Groovy console, CVE-2024-23897 file read, credential theft (3 guides)