{
  "port": 6025,
  "protocol": "tcp",
  "service": "X11 display :25",
  "oneLiner": "X11 display :25 — high display numbers like this usually mean many forwarded or virtual sessions.",
  "whatItIs": "IANA assigns the whole 6000-6063 range to X11, so 6025 is display :25. Display numbers this high normally come from a multi-user host: sshd hands each X11-forwarded session the next free display starting at :10, and Xvfb/Xvnc farms allocate them in bulk for headless browsers and test runners. Seeing it listening on a public interface means the X transport was left on TCP rather than confined to the loopback socket sshd normally uses.",
  "exposure": {
    "verdict": "never",
    "note": "Forwarded and virtual displays carry real sessions; exposing them over TCP hands out screen contents and input injection with only a cookie in the way."
  },
  "checkCommand": "xdpyinfo -display TARGET:25",
  "links": [
    {
      "title": "Xsecurity(7) — X display access control",
      "url": "https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man7/Xsecurity.7.xhtml",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6000-6063 (x11)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6025",
      "kind": "iana"
    }
  ]
}