{
  "port": 6901,
  "protocol": "tcp",
  "service": "KasmVNC (IANA: jetstream)",
  "oneLiner": "In practice a KasmVNC browser desktop; on paper, Novell's Jetstream messaging protocol.",
  "whatItIs": "IANA registered 6901/tcp as \"jetstream\" (Novell Jetstream messaging protocol) in 2010, but that is not what you find on a modern scan. KasmVNC and the Kasm Workspaces container images publish their web desktop on 6901 — the documented run line is `docker run -p 6901:6901 kasmweb/firefox` and the desktop is then reachable at https://host:6901 with a container user such as kasm_user. Kasm's own fixed-infrastructure docs use the same port when registering a standalone KasmVNC server. Seeing it open means someone is running a browser-accessible remote desktop.",
  "exposure": {
    "verdict": "never",
    "note": "It is a full remote desktop, and the stock container images ship with well-known default credentials; publish it through the Kasm gateway or a reverse proxy with real authentication, not directly."
  },
  "checkCommand": "curl -kI https://TARGET:6901/",
  "links": [
    {
      "title": "KasmVNC source repository",
      "url": "https://github.com/kasmtech/KasmVNC",
      "kind": "github"
    },
    {
      "title": "Kasm workspaces-images — manual container deployment on 6901",
      "url": "https://github.com/kasmtech/workspaces-images",
      "kind": "github"
    },
    {
      "title": "Kasm Workspaces — Fixed Infrastructure (KasmVNC on port 6901)",
      "url": "https://www.kasmweb.com/docs/latest/how_to/fixed_infrastructure.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6901",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6901",
      "kind": "iana"
    }
  ]
}