# VNC Authentication Probing

- **URL:** https://hackindex.io/services/vnc/enumeration/vnc-authentication-probing
- **Path:** VNC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/vnc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-01-19

VNC auth “probing” is reading the **RFB security types** the server offers. That tells you if the desktop is open, password-gated, or wrapped in TLS or vendor auth before you waste time with the wrong client.

## VNC authentication probing with Nmap

Probe a single port:

```bash
nmap -Pn -p $PORT --script vnc-info $TARGET_IP
# PORT    STATE SERVICE
# 5900/tcp open  vnc
# | vnc-info:
# |   Protocol version: 3.889
# |   Security types:
# |     Mac OS X security type (30)
# |_    Mac OS X security type (35)
```

Probe common displays:

```bash
nmap -Pn -p 5900-5910 --script vnc-info $TARGET_IP
```

`vnc-info` returns the RFB version and supported security types.

## Interpreting security types

The decision point is the security type list. Common values you’ll see in the wild:

**1 None**

- No authentication at the VNC layer.
- Next move: connect with a viewer immediately and validate you get a desktop.

**2 VNC Authentication**

- Classic VNC password challenge-response.
- Next move: credential validation or controlled password auditing.

**18 TLS / 19 VeNCrypt**

- You need a client that supports the offered crypto wrapper.
- Next move: try a modern viewer and don’t assume “not reachable” if your first client errors.

If you want the protocol-level meaning of “None” vs “VNC Authentication”, RFC 6143 is the authoritative reference.

## Confirm with a real viewer

Nmap tells you what’s offered. A viewer tells you what works and whether you land on a usable desktop.

TigerVNC `vncviewer` will prompt for a password if required.

```bash
vncviewer $TARGET_IP:$PORT
```

What to do with the behavior:

- Immediate desktop without a prompt usually matches `None`.
- Password prompt matches VNC Authentication or a compatible extended type.
- “No matching security types” means the server offered types your client doesn’t support. Switch client or tune security options instead of assuming it’s dead.

## Detect “no-auth VNC” quickly across many hosts

When you’re sweeping a network, you’re often hunting for `None` first.

```bash
nmap -Pn -n --open -p 5900-5910 --script vnc-info -iL targets.txt -oA vnc-auth-probe
grep -Rni "None" vnc-auth-probe.nmap
```

This is usually enough to prioritize immediate interactive access attempts.

## Edge cases

### Viewer says “No matching security types”

That’s almost always client capability mismatch, not “wrong creds”. The server is advertising security types your viewer can’t do. Use `vnc-info` to see what’s being offered, then switch viewers or enable support for that type.

### Port is open but no RFB banner

If you don’t see an RFB version string with a raw connect, you’re probably not talking to VNC on that port.

```bash
nc -nv $TARGET_IP $PORT
```

If it’s VNC, you should see `RFB 003.xxx` early in the handshake.

## Legacy

> [!NOTE]
> RealVNC auth-bypass checks target a very old RealVNC issue (CVE-2006-2369). Keep it as a quick legacy sanity-check, not a primary path.

```bash
nmap -Pn -p $PORT --script realvnc-auth-bypass $TARGET_IP
```

## References

- [vnc-info NSE script](https://nmap.org/nsedoc/scripts/vnc-info.html) - Enumerates RFB version and supported security types
- [RFC 6143 (RFB)](https://datatracker.ietf.org/doc/html/rfc6143) - Security handshake semantics for None vs VNC Authentication
- [IANA RFB Registry](https://www.iana.org/assignments/rfb/rfb.xhtml) - Security type value mappings (None, VNC Auth, TLS, VeNCrypt)
- [TigerVNC vncviewer](https://tigervnc.org/doc/vncviewer.html) - Viewer behavior and password prompting
- [realvnc-auth-bypass NSE script](https://nmap.org/nsedoc/scripts/realvnc-auth-bypass.html) - Legacy auth bypass check for RealVNC