{
  "port": 5901,
  "protocol": "tcp",
  "service": "VNC (RFB) display :1",
  "oneLiner": "A VNC server on display :1 — the standard first per-user desktop on a Linux box.",
  "whatItIs": "RFB uses 5900 plus the display number, so 5901 is display :1. On Linux this is the most common VNC port of all, because `vncserver` allocates :1 to the first user who starts a session, ahead of :0 which is usually the physical console. TigerVNC, TightVNC, and x11vnc all land here. The server answers every connection with a plaintext version banner such as `RFB 003.008` before authentication, so it is trivial to identify.",
  "exposure": {
    "verdict": "never",
    "note": "VNC authentication is a challenge-response over a DES key truncated to 8 characters, with the session itself unencrypted, and many servers are configured with no auth at all. Bind it to localhost and forward it over SSH."
  },
  "checkCommand": "nc -w 3 TARGET 5901 | head -c 12; echo",
  "links": [
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    },
    {
      "title": "TigerVNC/tigervnc",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 5901 (unassigned; 5900 is rfb)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5901",
      "kind": "iana"
    }
  ]
}