automation server to build and test projects continuously
written in java (Jenkins was previously called Hudson)
it runs in servlet containers like Tomcat
Discovery
for an Internal pentest: we've completed our web discovery and find what we believe is a Jenkins instance.
usually running on Windows servers as the all-powerful SYSTEM account.
If we gain access via Jenkins and gain remote code execution as the SYSTEM account, we would have a foothold in AD to begin enumeration of the domain environment.
Jenkins runs on Tomcat port 8080 by default.
uses port 5000 for slave servers - used for commz between a master and a slave
Jenkins can use a local database, LDAP, Unix user database, delegate security to a servlet container, or use no authentication at all. Administrators can also allow or disallow users from creating accounts.