gquere/pwn_jenkins resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2096 stars · 326 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of notes, scripts, and references for attacking and pentesting Jenkins CI/CD servers, covering known CVEs like arbitrary file read and deserialization RCE. It includes Python exploit scripts and command-line examples using jenkins-cli and ysoserial.

Use cases

• test a jenkins server for cve-2024-23897 arbitrary file read
• exploit deserialization rce on an old jenkins instance
• check if jenkins authentication can be bypassed
• find scripts to get rce on jenkins during a pentest
• learn about known jenkins vulnerabilities and exploits
• bruteforce the jenkins credential encryption key

When to choose

• you are doing an authorized penetration test against a Jenkins server
• you want a curated reference of Jenkins CVEs with working exploit commands
• you need ready-made Python exploit scripts for Jenkins vulnerabilities

When to avoid

• you need a hardened Jenkins security scanner for production use
• you want defensive hardening guidance rather than attack tooling
• you need a maintained tool with a license and formal releases

Facets

learning-resource · maturity active

penetration-testing security developer-tools security penetration-testing python cli cross-platform jenkins exploitation rce cve pentest-notes offensive-security devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="gquere/pwn_jenkins")