Finding 500 errors and XSS attacks in Jenkins through fuzzing

This recipe describes using a to find server-side and XSS attacks in your Jenkins servers.

A goes through a series of URLs, appends parameters blindly, and checks the server's response. The inputted parameters are variations on scripting commands, such as <script>alert("random string");</script>. An attack vector is found if the server's response includes the unescaped version of the script.

Cross-site scripting attacks are currently one of the more forms of attack (http://en.wikipedia.org/wiki/Cross-site_scripting). The attack involves injecting script fragments into the client's browser so that the script runs as if it comes from a trusted website. For example, once you have logged in to an application, it is probable that your session ID is stored in a cookie. The injected script might read the value in the cookie and then send the information to another server ready for an attempt at reuse.

A fuzzer discovers...