Uncle Rat’s Jenkins Hacking Handbook

Install and configure Jenkins as a master server with optional slaves, update repositories, install Java and JDK, set up plugins and pipelines, and configure security, notifications, and source code management.

Create the admin user named Jenkins and configure the Jenkins URL to begin using the instance. Explore the users, credentials, and manage Jenkins settings to add agents and trigger pipelines.

Learn to create Jenkins jobs, from freestyle projects to pipelines and multi branch pipelines, using folders and organizational folders; configure parameters, triggers, SCM connections, and build steps with security.

Explore advanced Jenkins job configuration with distributed builds, agents, and on-demand cloud provisioning, while assessing security risks like reverse shells and running jobs on the server.

Explore Jenkins security management, including LDAP Active Directory integration, authentication and authorization models, and how anonymous or misconfigured rights can expose data or enable unauthorized job creation.

Explore the Jenkins CLI's command line power, including creating and managing jobs, editing plugins, and using the groovy scripting console for tasks and potential reverse shell demonstrations.

Explore how to build projects and manage Jenkins pipelines while examining security essentials, plugin management, credentials, script approvals, and the risk of a reverse shell on outdated setups.

Master Jenkins security by understanding common exploits, from enumeration to deserialization and remote code execution, and learn practical mitigation methods for protecting credentials and secrets.

Explore advanced exploit scenarios in Jenkins security, including reverse shells, remote code execution, and abusing builds, pipelines, and credentials to take control of a Jenkins server.

Set up your own Jenkins instance and experiment with it by creating useful pipelines you can apply in your life. Build on what you learned and keep exploring.