Skip to content
HackIndex logo

HackIndex

VNC Service Discovery and Version Fingerprinting

4 min read Jan 19, 2026

VNC is RFB over TCP, usually 5900 + display. Many hosts also expose an HTTP viewer on 5800 + display, but it’s often disabled.

Fast path

Hit the common display range and pull RFB version + supported security types.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5900-5910 --script vnc-info $TARGET_IP

If you already have a specific port:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT --script vnc-info $TARGET_IP

What you expect back is a protocol version and a list of security types. That’s the decision point for “open desktop”, “password required”, or “TLS wrapper / vendor auth”.

vnc-info does exactly that: protocol version + supported security types.

Confirm the web viewer port (optional)

If you see 590x open, it’s worth a quick check for the paired 580x.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5800-5810 -sV $TARGET_IP

If 580x is open, it might be a legacy Java viewer or a thin web front-end. Treat it as a separate HTTP surface, not “VNC over HTTP”.

Manual RFB banner grab (when you want zero tooling)

RFB starts with a 12-byte ASCII version string.

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT 
RFB 003.008

If you get nothing back, the port is filtered, the service is not speaking RFB, or you’re hitting something wrapped (rare on raw VNC ports, common behind proxies).

Desktop name and geometry (only when it’s “None” or you already have creds)

vnc-title attempts to log in and pull the desktop name and geometry. It’s categorized as intrusive and will try auth paths.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT --script vnc-title $TARGET_IP

Use this when:

  • vnc-info shows None security, or

  • you already validated creds elsewhere and want a quick confirmation target.

Interpreting output

Protocol version

You’ll see versions like RFB 003.003, RFB 003.007, RFB 003.008. Those correspond to 3.3, 3.7, 3.8. Anything “weird” is commonly treated as 3.3 behavior.

What this changes:

  • 3.3-style servers often correlate with older implementations and simpler security negotiation.

  • It’s not an exploit signal by itself. Use it to sanity-check what your client supports and what handshake behavior to expect.

Security types

From vnc-info, you’re looking for the security types list.

What to do with common outcomes:

None

  • No authentication at the VNC layer.

  • Next move is a straight viewer connection to confirm you get a desktop.

VNC Authentication

  • Classic VNC challenge-response password gate.

  • Next move is credential validation or controlled password auditing.

Vendor or extended security types

  • Common on TightVNC/UltraVNC derivatives and enterprise deployments.

  • Next move is to switch to a client that supports the negotiated types, or check if the server offers a fallback type alongside it.

If vnc-info returns a protocol version but no usable security types, treat it as “VNC is there but my tooling can’t complete the handshake”. That’s usually client capability mismatch, not “closed”.

What to do next

If you got None:

  • Try a viewer immediately (and screenshot what you land on).

  • Prioritize data access and local privilege paths over password work.

If you got VNC Authentication:

  • Move into VNC credential validation and then interactive access once you have a hit.

If you got only extended or vendor types:

  • Confirm with a real VNC client and don’t assume “not exploitable”. Some environments block simple clients but still allow interactive access with a compatible one.

If the port is open but not RFB:

  • Re-run with -sV --version-all and treat it as “service on a VNC port”, not VNC.

Variants

Scan a subnet quickly for VNC + fingerprint

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5900-5910 --open --script vnc-info -iL targets.txt -oA vnc-fingerprint

Non-standard port that you suspect is VNC

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT -sV --script vnc-info $TARGET_IP

Edge cases

Multiple displays, multiple listeners

Seeing 5900 and 5901 open usually means multiple displays or separate instances. Treat each as its own target. The security types can differ per display.

“Looks like VNC” but Nmap won’t fingerprint

Grab the raw RFB banner with nc. If the banner is present, it’s VNC. If the banner is absent, it’s not speaking RFB on that port, or something is interfering before handshake.

References