{
  "port": 6002,
  "protocol": "tcp",
  "service": "X11 (display :2)",
  "oneLiner": "X display :2 — a third X server on the host, physical or virtual.",
  "whatItIs": "Within IANA's x11 block, 6002 is display :2. It appears on multi-seat machines, on hosts running several Xvnc or Xvfb instances, and on terminal servers that give each session its own display. Everything true of 6000 applies unchanged: host-list or magic-cookie authorization, no encryption, and `-nolisten tcp` as the modern default that has been overridden if the port is open.",
  "exposure": {
    "verdict": "never",
    "note": "There is no safe way to publish an X display. Keep it on the Unix socket or loopback and forward it over SSH."
  },
  "checkCommand": "nmap -Pn -p 6002 --script x11-access TARGET",
  "links": [
    {
      "title": "X.Org — Xserver(1) manual page",
      "url": "https://xorg.freedesktop.org/archive/current/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=x11",
      "kind": "iana"
    }
  ]
}