VNC's handshake exposes useful information before authentication. The server first announces its RFB protocol version; after the client replies, security negotiation identifies the types the server supports. The list can show None, legacy VNC Authentication, TLS, VeNCrypt, SASL, or vendor extensions. These values describe available mechanisms and can suggest an implementation, but exact product and version identification normally requires corroborating endpoint, package, service, or firmware evidence. Match vulnerabilities only after that identification is sufficiently reliable.
nmap -p5900 --script vnc-info <target> # RFB version + supported security types
# raw handshake: the server sends "RFB 003.00X" then the security-type list
nc <target> 5900 | head -c 12 # RFB protocol version banner
Subtopics#
- Banner grabbing: the RFB version string.
- Implementation detection: identifying RealVNC, TightVNC, UltraVNC.