VNC

VNC shares a graphical desktop over the RFB protocol (typically ports 5900+). Its weaknesses are a short challenge-response password scheme capped at eight characters, servers left with no authentication, cleartext screen and input traffic, a negotiable security type that can be downgraded, and implementation-specific authentication bypasses in RealVNC and TightVNC.

1 phút đọccập nhật 7 thg 10, 2026florianamette1 người đóng góp
Hỏi trợ lý của bạn (MCP)Sửa trên GitHub

VNC (Virtual Network Computing) shares a graphical desktop using the Remote Framebuffer (RFB) protocol, commonly on TCP 5900 plus the display number. RFB supports multiple security types, and implementations add further extensions. None and legacy VNC Authentication do not encrypt subsequent protocol data; the latter uses a DES challenge-response and only the first eight password bytes. Other types can add TLS, SASL, RSA-AES, SSH, or vendor-specific protection. Evaluate the security types actually offered and selected, the password and access policy, and the exact implementation and version. Treat vulnerabilities as advisory-specific findings, such as CVE-2006-2369 in RealVNC 4.1.0–4.1.1.

bash
nmap -p5900-5902 --script vnc-info,vnc-title,realvnc-auth-bypass <target>
vncviewer <target>::5900                       # connect to test auth/no-auth

Subtopics#

  • Enumeration: RFB version, security types, and implementation.
  • Authentication: security types, legacy passwords, configuration, and advisory-specific bypasses.
  • Transport security: selected cleartext or protected modes and conditional downgrade risk.

References#

TrướcSession hijackingTiếp Authentication