This recipe details the automatic testing of Jenkins for well-known security issues with w3af, a penetration testing tool from the Open Web Application Security Project (OWASP). For more information, visit http://w3af.sourceforge.net. OWASP's purpose is to make application security visible. The OWASP's top 10 lists of insecurities for 2010 include the following:
- A2-Cross-site Scripting (XSS): An XSS attack can occur when an application returns an unescaped input to a client's browser. The Jenkins administrator can do this by default through the job description.
- A6-Security Misconfiguration: A Jenkins plugin gives you the power to write custom authentication scripts. It is easy to get scripts wrong through misconfiguration.
- A7-Insecure Cryptographic Storage: There are over 600 plugins for Jenkins, each storing its...