WHATPORT(5800) whatport.net WHATPORT(5800)
5800

VNC over HTTP (display :0)

A VNC server's built-in web server, handing a browser the Java applet viewer for display :0.

TCP IANA registry

Description

Classic VNC servers — RealVNC, TightVNC, UltraVNC, x11vnc — embed a small HTTP server at 5800 plus the display number, so display :0 answers on 5800. Fetch it and you get an HTML page plus a Java applet that then opens its own RFB connection to 5900. The applet half is dead in practice since browsers removed NPAPI Java, but the listener survives in older installs and is a dependable fingerprint that a VNC server is running next door. IANA has never assigned 5800; the whole convention comes from the VNC implementations.

Exposed to the internet?

Do not expose

It advertises a VNC server to anyone who loads the page, and the RFB service it fronts authenticates with a DES challenge over a key truncated to 8 characters, with no transport encryption. Reach VNC over SSH or a VPN instead.

Check it yourself

$ curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5800/

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.