# Jenkins Enumeration

> Enumerate Jenkins instances to identify version, exposed build configs, credentials, script console access, and misconfigured permissions for privilege escalation.

- **URL:** https://hackindex.io/services/jenkins/enumeration/jenkins-enumeration
- **Path:** Jenkins > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/jenkins/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Jenkins runs on port 8080 by default and exposes a web interface and REST API. Enumeration identifies the version, authentication requirements, accessible endpoints, users, and jobs before testing for specific vulnerabilities.

## Version Detection

Jenkins returns its version in the `X-Jenkins` response header on every page, including the login page. No authentication required.

```bash
curl -sI http://$TARGET_IP:$PORT/ | grep -i x-jenkins
# X-Jenkins: 2.426.2
# X-Jenkins-Session: abc123def456
```

The version number maps directly to known CVEs. Check it against the Jenkins security advisories at `jenkins.io/security/advisories/`.

## Nmap Service Detection

Nmap fingerprints Jenkins through the HTTP response headers and page content.

```bash
nmap -sV -p $PORT $TARGET_IP
# PORT     STATE SERVICE VERSION
# 8080/tcp open  http    Jetty 10.0.18
# |_http-title: Dashboard [Jenkins]
```

## Authentication Check

Unauthenticated Jenkins instances expose the full dashboard without login. Test whether the main page redirects to `/login` or returns the dashboard directly.

```bash
curl -s -o /dev/null -w '%{http_code} %{redirect_url}' http://$TARGET_IP:$PORT/
# 200 
```

## API Enumeration

The Jenkins JSON API returns structured data about jobs, builds, nodes, and users. Append `/api/json` to any page URL to get its JSON representation.

**List all jobs**

```bash
curl -s http://$TARGET_IP:$PORT/api/json?tree=jobs[name,url,color] | python3 -m json.tool
# {
#   "jobs": [
#     {
#       "name": "deploy-production",
#       "url": "http://jenkins:8080/job/deploy-production/",
#       "color": "blue"
#     },
#     {
#       "name": "backup-database",
#       "url": "http://jenkins:8080/job/backup-database/",
#       "color": "red"
#     }
#   ]
# }
```

**Enumerate build console output for credentials**

```bash
curl -s http://$TARGET_IP:$PORT/job/deploy-production/lastBuild/consoleText
```

## User Enumeration

Jenkins exposes a people directory listing all users who have triggered builds or committed code.

```bash
curl -s http://$TARGET_IP:$PORT/asynchPeople/api/json | python3 -c "import sys,json; [print(u['user']['fullName']) for u in json.load(sys.stdin)['users']]"
# admin
# john.doe
# ci-bot
```

## Key Endpoints to Check

Test each of these endpoints with and without authentication. Some remain accessible even when the main dashboard requires login.

- `/script`: Groovy script console. If accessible, leads directly to [RCE via Groovy](https://hackindex.io/services/jenkins/exploitation/jenkins-groovy-console-rce).
- `/credentials/`: stored credentials overview. Detailed extraction covered in [credential extraction](https://hackindex.io/services/jenkins/exploitation/jenkins-credential-extraction).
- `/manage`: admin management page with system configuration.
- `/systemInfo`: JVM version, OS, environment variables.
- `/env`: environment variables (may contain secrets).
- `/jnlpJars/jenkins-cli.jar`: CLI client download. Used in [CVE-2024-23897](https://hackindex.io/services/jenkins/exploitation/jenkins-arbitrary-file-read-cve-2024-23897).

## References

- [Jenkins: Remote Access API](https://www.jenkins.io/doc/book/using/remote-access-api/) - Official API documentation for job, build, and user enumeration.
- [Hackviser: Jenkins Pentesting](https://hackviser.com/tactics/pentesting/services/jenkins) - Enumeration and exploitation techniques for Jenkins.