{
  "port": 5801,
  "protocol": "tcp",
  "service": "VNC over HTTP (display :1)",
  "oneLiner": "The same VNC web-viewer port as 5800, one display up: display :1.",
  "whatItIs": "VNC servers place their HTTP viewer listener at 5800 plus the display number, so 5801 is display :1 — the first display a Linux `vncserver` normally creates for a user. The page it serves is a Java applet that connects onward to the matching RFB port, 5901. IANA has never assigned 5801; seeing it open means a VNC server with a per-user display is running, and 5901 is almost certainly open too.",
  "exposure": {
    "verdict": "never",
    "note": "Same problem as 5800: it publicly identifies a VNC server whose RFB authentication is weak and unencrypted. Keep both this and 5901 on the loopback or behind an SSH tunnel."
  },
  "checkCommand": "curl -sS -o /dev/null -w '%{http_code}\\n' http://TARGET:5801/",
  "links": [
    {
      "title": "x11vnc — -http option, Java vncviewer download on the 5800+display port",
      "url": "https://github.com/LibVNC/x11vnc/blob/master/src/help.c",
      "kind": "github"
    },
    {
      "title": "TigerVNC — the VNC/RFB server most Linux distributions ship",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 5801 (unassigned)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5801",
      "kind": "iana"
    }
  ]
}