{
  "port": 6009,
  "protocol": "tcp",
  "service": "X11 display :9",
  "oneLiner": "X11 display :9 — the last display number below where SSH X11 forwarding starts.",
  "whatItIs": "TCP 6009 is X display :9 under IANA's 6000-6063 x11 registration. It is worth knowing because sshd's X11DisplayOffset defaults to 10, so forwarded X sessions begin at :10 (port 6010) precisely to avoid colliding with real local displays like this one. A listener on 6009 therefore means a genuine X server with TCP transport enabled, not an SSH forwarding artifact. That is unusual on a current system, where X normally runs with -nolisten tcp.",
  "exposure": {
    "verdict": "never",
    "note": "Unauthenticated or xhost-permissive X over TCP gives an attacker the display, the keyboard, and the clipboard; tunnel X through SSH instead of opening the port."
  },
  "checkCommand": "nc -vz TARGET 6009",
  "links": [
    {
      "title": "Xserver(1) — display numbers and -nolisten",
      "url": "https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6009",
      "kind": "iana"
    }
  ]
}