{
  "port": 5900,
  "protocol": "tcp",
  "service": "VNC (RFB)",
  "oneLiner": "A VNC server — someone's desktop is available for remote control on display :0.",
  "whatItIs": "RFB is the wire protocol behind VNC, and 5900 is display :0 (5901 is :1, and so on up). You will find it on macOS with Screen Sharing enabled, on Linux hosts running TigerVNC, x11vnc, or a Raspberry Pi with RealVNC, and on hypervisor consoles from QEMU/KVM, Proxmox, and ESXi. The server greets every connection with a plaintext version banner such as RFB 003.008 before any authentication happens, which makes it trivial to fingerprint.",
  "exposure": {
    "verdict": "never",
    "note": "Classic VNC authentication is a challenge-response over a DES key truncated to 8 characters with no transport encryption, and many servers permit no auth at all — tunnel it over SSH or a VPN instead."
  },
  "checkCommand": "nc -w 3 TARGET 5900 | head -c 12; echo",
  "links": [
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 5900 (rfb)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5900",
      "kind": "iana"
    },
    {
      "title": "TigerVNC/tigervnc",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    }
  ]
}