{
  "port": 6005,
  "protocol": "tcp",
  "service": "X11 display :5",
  "oneLiner": "X Window System display number 5 — inside IANA's 6000-6063 x11 block.",
  "whatItIs": "An X server listening for TCP clients uses port 6000 plus its display number, so display :5 is TCP 6005. Modern desktops start the X server with -nolisten tcp (or run Wayland), so nothing binds here unless someone deliberately re-enabled TCP transport. When it is open it is usually a thin client, an X terminal, or a headless Xvfb instance started for CI screenshots. Access is then gated only by whatever xhost/xauth policy the server was started with.",
  "exposure": {
    "verdict": "never",
    "note": "An X server reachable over TCP with xhost + or a leaked MIT-MAGIC-COOKIE-1 lets anyone read the screen, log keystrokes, and inject input; keep X on Unix sockets and forward it over SSH."
  },
  "checkCommand": "xdpyinfo -display TARGET:5",
  "links": [
    {
      "title": "Xserver(1) — X server options including -nolisten",
      "url": "https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "Xsecurity(7) — X display access control",
      "url": "https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man7/Xsecurity.7.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6005",
      "kind": "iana"
    }
  ]
}