A VNC server — someone's desktop is available for remote control on display :0.
RFB is the wire protocol behind VNC, and 5900 is display :0 (5901 is :1, and so on up). You will find it on macOS with Screen Sharing enabled, on Linux hosts running TigerVNC, x11vnc, or a Raspberry Pi with RealVNC, and on hypervisor consoles from QEMU/KVM, Proxmox, and ESXi. The server greets every connection with a plaintext version banner such as RFB 003.008 before any authentication happens, which makes it trivial to fingerprint.
Do not expose
Classic VNC authentication is a challenge-response over a DES key truncated to 8 characters with no transport encryption, and many servers permit no auth at all — tunnel it over SSH or a VPN instead.
$ nc -w 3 TARGET 5900 | head -c 12; echoSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.