{
  "port": 6000,
  "protocol": "tcp",
  "service": "X11 (display :0)",
  "oneLiner": "An X server accepting TCP connections on display :0 — the classic \"your desktop is open\" finding.",
  "whatItIs": "IANA assigns 6000-6063 to `x11`, the X Window System, one port per display: 6000 is display :0, 6001 is :1, and so on. An X server that has not been told otherwise listens on TCP as well as its Unix socket, and access is decided by a host list (xhost) or a MIT-MAGIC-COOKIE-1 token in ~/.Xauthority. Modern distributions start the server with `-nolisten tcp`, so an open 6000 means someone explicitly re-enabled TCP — usually to make remote GUI apps work without SSH X forwarding.",
  "exposure": {
    "verdict": "never",
    "note": "An X client can read the whole screen, grab the clipboard, and inject synthetic keystrokes. With `xhost +` there is no authentication at all, and the protocol is cleartext regardless — use `ssh -X` instead."
  },
  "checkCommand": "xdpyinfo -display TARGET:0",
  "links": [
    {
      "title": "X.Org — Xserver(1) manual page (-nolisten, xhost, authorization)",
      "url": "https://xorg.freedesktop.org/archive/current/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=x11",
      "kind": "iana"
    },
    {
      "title": "xorg/xserver",
      "url": "https://gitlab.freedesktop.org/xorg/xserver",
      "kind": "official-docs"
    }
  ]
}