{
  "port": 6001,
  "protocol": "tcp",
  "service": "X11 (display :1)",
  "oneLiner": "The second X display — very often an Xvnc or Xvfb server rather than a physical screen.",
  "whatItIs": "6001 is display :1 inside IANA's 6000-6063 x11 range. On a workstation it is the second X server; far more often it belongs to a headless one — Xvfb for CI screenshot jobs, or the X server side of a VNC session started as `vncserver :1`, which pairs it with RFB on 5901. Scan data shows it open slightly more often than 6000, which fits the headless-server pattern.",
  "exposure": {
    "verdict": "never",
    "note": "Same protocol, same problem: a connected client can screenshot and inject input. Bind the X server to localhost and reach it over SSH forwarding or through the VNC layer, not directly."
  },
  "checkCommand": "xdpyinfo -display TARGET:1",
  "links": [
    {
      "title": "X.Org — Xserver(1) manual page",
      "url": "https://xorg.freedesktop.org/archive/current/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=x11",
      "kind": "iana"
    },
    {
      "title": "TigerVNC/tigervnc",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    }
  ]
}