Enumeration

VNC enumeration reads the RFB protocol version and the security types the server offers during the unauthenticated handshake, and identifies the implementation (RealVNC, TightVNC, UltraVNC). The security types reveal whether the server requires no authentication or the weak VNC password scheme, and the implementation maps to specific authentication-bypass flaws.

1 phút đọccập nhật 7 thg 10, 2026florianamette1 người đóng góp
Hỏi trợ lý của bạn (MCP)Sửa trên GitHub

VNC's handshake exposes useful information before authentication. The server first announces its RFB protocol version; after the client replies, security negotiation identifies the types the server supports. The list can show None, legacy VNC Authentication, TLS, VeNCrypt, SASL, or vendor extensions. These values describe available mechanisms and can suggest an implementation, but exact product and version identification normally requires corroborating endpoint, package, service, or firmware evidence. Match vulnerabilities only after that identification is sufficiently reliable.

bash
nmap -p5900 --script vnc-info <target>         # RFB version + supported security types
# raw handshake: the server sends "RFB 003.00X" then the security-type list
nc <target> 5900 | head -c 12                  # RFB protocol version banner

Subtopics#

References#

TrướcWeak encryptionTiếp Banner grabbing