Jenkins reconnaissance and enumeration

Enumeration for Jenkins is a very important aspect of penetration testing. Activity information that's retrieved while performing reconnaissance and enumeration can help penetration testers exploit the Jenkins instance.

There are a few ways to determine the installation and version detection processes of Jenkins. We will go through these now and then cover how to exploit Jenkins.

Detecting Jenkins using favicon hashes

Jenkins has a very unique favicon, and when converted into hash form, it becomes 81586312. This hash can be used to identify a Jenkins installation; it can even be used on Shodan to identify systems running Jenkins.

The following screenshot shows how the hash value...