Questions tagged [jenkins]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
81 views

Can master secret to Hashicorp Vault can be retrieved from Jenkins?

In Jenkins there is a way to see secrets in plaintext by using Manage Jenkins > Script Console feature as described here. The access to this console is limited to Jenkins administrator only but ...
user avatar
  • 233
0 votes
1 answer
249 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
user avatar
  • 79
3 votes
0 answers
94 views

Secure a Jenkins node to only run approved scripts?

We have a series of Jenkins nodes that are used to deploy changes onto our SQL Servers, which works fine as long as everyone behaves and can be trusted. The worry is that a rogue developer or hacker ...
user avatar
2 votes
1 answer
141 views

Webhook Security

I'm following this guide on: How to set up CI/CD Pipeline for a node.js app with Jenkins I've installed Jenkins on a VPS and I can access the Web UI over an SSH Tunnel. Then I saw this: http://...
user avatar
1 vote
2 answers
575 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
user avatar
1 vote
0 answers
819 views

OWASP ZAP does not scan all urls in Jenkins

I have two set ups with ZAP and Selenium, local and on Jenkins. Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
user avatar
  • 109
2 votes
1 answer
808 views

Running Selenium Jenkins, through OWASP ZAP, before scanning

I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated. I am attempting ...
user avatar
  • 109
1 vote
1 answer
237 views

What is the expected TLS traffic from Jenkins?

Given: We start a Jenkins instance on a Windows host as a Service. It looks like the server is correctly configured (--httpPort=-1 --httpsPort=8080 etc) and has an own key store. There is no proxy in ...
user avatar
2 votes
3 answers
1k views

Owasp Zap's active scan harming the database

I want to integrate OWASP Zap security tests in my continuous integration chain using the official Jenkins plugin. However, since it injects harmful payloads in database, I don't want the database to ...
user avatar
3 votes
2 answers
2k views

HP Fortify scan automation

I am asked to integrate the code audit tool HP Fortify in our development process, but the main constraint about it is that the whole code should not be scanned every time: only the classes impacted ...
user avatar
  • 225
1 vote
0 answers
2k views

ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port

I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least). ...
user avatar
  • 490