Skip to content
HackIndex.io

Jenkins Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Jenkins runs on port 8080 by default and exposes a web interface and REST API. Enumeration identifies the version, authentication requirements, accessible endpoints, users, and jobs before testing for specific vulnerabilities.

Version Detection

Jenkins returns its version in the X-Jenkins response header on every page, including the login page. No authentication required.

┌──(kali㉿kali)-[~]
└─$ curl -sI http://$TARGET_IP:$PORT/ | grep -i x-jenkins 
X-Jenkins: 2.426.2
X-Jenkins-Session: abc123def456

The version number maps directly to known CVEs. Check it against the Jenkins security advisories at jenkins.io/security/advisories/.

Nmap Service Detection

Nmap fingerprints Jenkins through the HTTP response headers and page content.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
PORT     STATE SERVICE VERSION
8080/tcp open  http    Jetty 10.0.18
|_http-title: Dashboard [Jenkins]
Explain command
-sV Probe open ports to determine service/version info.

Jenkins runs on Jetty. The page title confirms the instance.

Authentication Check

Unauthenticated Jenkins instances expose the full dashboard without login. Test whether the main page redirects to /login or returns the dashboard directly.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code} %{redirect_url}' http://$TARGET_IP:$PORT/ 
200

200 with no redirect means unauthenticated access. 403 or a redirect to /login means authentication is enforced. Even with auth enabled, some endpoints may still be accessible.

API Enumeration

The Jenkins JSON API returns structured data about jobs, builds, nodes, and users. Append /api/json to any page URL to get its JSON representation.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:$PORT/api/json?tree=jobs[name,url,color] | python3 -m json.tool 
{
  "jobs": [
    {
      "name": "deploy-production",
      "url": "http://jenkins:8080/job/deploy-production/",
      "color": "blue"
    },
    {
      "name": "backup-database",
      "url": "http://jenkins:8080/job/backup-database/",
      "color": "red"
    }
  ]
}

Job names reveal internal project names, deployment targets, and infrastructure. Color indicates last build status: blue = success, red = failure, disabled = grey.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:$PORT/job/deploy-production/lastBuild/consoleText

Build logs often contain credentials, API keys, internal hostnames, and deployment paths leaked through environment variables or command output.

User Enumeration

Jenkins exposes a people directory listing all users who have triggered builds or committed code.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:$PORT/asynchPeople/api/json | python3 -c "import sys,json; [print(u['user']['fullName']) for u in json.load(sys.stdin)['users']]" 
admin
john.doe
ci-bot

Key Endpoints to Check

Test each of these endpoints with and without authentication. Some remain accessible even when the main dashboard requires login.

  • /script: Groovy script console. If accessible, leads directly to RCE via Groovy.
  • /credentials/: stored credentials overview. Detailed extraction covered in credential extraction.
  • /manage: admin management page with system configuration.
  • /systemInfo: JVM version, OS, environment variables.
  • /env: environment variables (may contain secrets).
  • /jnlpJars/jenkins-cli.jar: CLI client download. Used in CVE-2024-23897.

References