RFB supports multiple security types, and implementations add further authentication mechanisms. A server offering None permits a connection without RFB authentication. Legacy VNC Authentication uses a DES challenge-response and, in implementations that follow the classic scheme, uses only the first eight password bytes. Online guessing depends on password quality and server-side attempt controls; a captured challenge-response permits offline verification of candidates. Implementation vulnerabilities must be tied to an exact advisory, such as CVE-2006-2369 in RealVNC 4.1.0 and 4.1.1, rather than inferred from the product family.
vncviewer <target>::5900 # prompts (or not) depending on security type
nmap -p5900 --script vnc-info,realvnc-auth-bypass <target>
Subtopics#
- No authentication: servers offering the None security type.
- Default passwords: vendor and guessable VNC passwords.
- Password brute force: online and offline attacks on the VNC password.
- RealVNC auth bypass: the RealVNC security-type bypass.
- TightVNC advisory assessment: requiring evidence for version-specific claims.