# WHATPORT(5800)

## NAME

port 5800 — VNC over HTTP (display :0) — A VNC server's built-in web server, handing a browser the Java applet viewer for display :0.

Protocol: TCP  
IANA registry

## DESCRIPTION

Classic VNC servers — RealVNC, TightVNC, UltraVNC, x11vnc — embed a small HTTP server at 5800 plus the display number, so display :0 answers on 5800. Fetch it and you get an HTML page plus a Java applet that then opens its own RFB connection to 5900. The applet half is dead in practice since browsers removed NPAPI Java, but the listener survives in older installs and is a dependable fingerprint that a VNC server is running next door. IANA has never assigned 5800; the whole convention comes from the VNC implementations.

## EXPOSURE

**Do not expose.** It advertises a VNC server to anyone who loads the page, and the RFB service it fronts authenticates with a DES challenge over a key truncated to 8 characters, with no transport encryption. Reach VNC over SSH or a VPN instead.

## CHECK

```sh
curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5800/
```

## SEE ALSO

- source — [x11vnc — -http option, "port 5800 and allow the Java vncviewer to be downloaded"](https://github.com/LibVNC/x11vnc/blob/master/src/help.c) (github.com)
- spec — [RFC 6143 — The Remote Framebuffer Protocol](https://datatracker.ietf.org/doc/html/rfc6143) (datatracker.ietf.org)
- iana — [IANA port registry — 5800 (unassigned)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5800) (iana.org)

---

HTML: <https://whatport.net/5800/> · JSON: <https://whatport.net/5800.json> · full dataset: <https://whatport.net/ports.json>