# VNC Service Discovery and Version Fingerprinting

- **URL:** https://hackindex.io/services/vnc/enumeration/vnc-service-discovery-and-version-fingerprinting
- **Path:** VNC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/vnc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-01-19

VNC is RFB over TCP, usually **5900 + display**. Many hosts also expose an HTTP viewer on **5800 + display**, but it’s often disabled.

## VNC version fingerprinting with Nmap

Hit the common display range and pull RFB version + supported security types.

```bash
nmap -Pn -p 5900-5910 --script vnc-info $TARGET_IP
```

If you already have a specific port:

```bash
nmap -Pn -p $PORT --script vnc-info $TARGET_IP
```

What you expect back is a protocol version and a list of security types. That’s the decision point for “open desktop”, “password required”, or “TLS wrapper / vendor auth”.

`vnc-info` does exactly that: protocol version + supported security types.

## Confirm the web viewer port (optional)

If you see 590x open, it’s worth a quick check for the paired 580x.

```bash
nmap -Pn -p 5800-5810 -sV $TARGET_IP
```

If 580x is open, it might be a legacy Java viewer or a thin web front-end. Treat it as a separate HTTP surface, not “VNC over HTTP”.

## Manual RFB banner grab (when you want zero tooling)

RFB starts with a 12-byte ASCII version string.

```bash
nc -nv $TARGET_IP $PORT
# RFB 003.008
#
```

If you get nothing back, the port is filtered, the service is not speaking RFB, or you’re hitting something wrapped (rare on raw VNC ports, common behind proxies).

## Desktop name and geometry (only when it’s “None” or you already have creds)

`vnc-title` attempts to log in and pull the desktop name and geometry. It’s categorized as intrusive and will try auth paths.

```bash
nmap -Pn -p $PORT --script vnc-title $TARGET_IP
```

Use this when:

- `vnc-info` shows **None** security, or
- you already validated creds elsewhere and want a quick confirmation target.

## Interpreting output

### Protocol version

You’ll see versions like `RFB 003.003`, `RFB 003.007`, `RFB 003.008`. Those correspond to 3.3, 3.7, 3.8. Anything “weird” is commonly treated as 3.3 behavior.

What this changes:

- 3.3-style servers often correlate with older implementations and simpler security negotiation.
- It’s not an exploit signal by itself. Use it to sanity-check what your client supports and what handshake behavior to expect.

### Security types

From `vnc-info`, you’re looking for the security types list.

What to do with common outcomes:

**None**

- No authentication at the VNC layer.
- Next move is a straight viewer connection to confirm you get a desktop.

**VNC Authentication**

- Classic VNC challenge-response password gate.
- Next move is credential validation or controlled password auditing.

**Vendor or extended security types**

- Common on TightVNC/UltraVNC derivatives and enterprise deployments.
- Next move is to switch to a client that supports the negotiated types, or check if the server offers a fallback type alongside it.

If `vnc-info` returns a protocol version but no usable security types, treat it as “VNC is there but my tooling can’t complete the handshake”. That’s usually client capability mismatch, not “closed”.

## What to do next

If you got **None**:

- Try a viewer immediately (and screenshot what you land on).
- Prioritize data access and local privilege paths over password work.

If you got **VNC Authentication**:

- Move into VNC credential validation and then interactive access once you have a hit.

If you got **only extended or vendor types**:

- Confirm with a real VNC client and don’t assume “not exploitable”. Some environments block simple clients but still allow interactive access with a compatible one.

If the port is open but **not RFB**:

- Re-run with `-sV --version-all` and treat it as “service on a VNC port”, not VNC.

## Variants

### Scan a subnet quickly for VNC + fingerprint

```bash
nmap -Pn -p 5900-5910 --open --script vnc-info -iL targets.txt -oA vnc-fingerprint
```

### Non-standard port that you suspect is VNC

```bash
nmap -Pn -p $PORT -sV --script vnc-info $TARGET_IP
```

## Edge cases

### Multiple displays, multiple listeners

Seeing 5900 and 5901 open usually means multiple displays or separate instances. Treat each as its own target. The security types can differ per display.

### “Looks like VNC” but Nmap won’t fingerprint

Grab the raw RFB banner with `nc`. If the banner is present, it’s VNC. If the banner is absent, it’s not speaking RFB on that port, or something is interfering before handshake.

## References

- [Nmap vnc-info NSE script](https://nmap.org/nsedoc/scripts/vnc-info.html) - Protocol version + supported security types
- [Nmap vnc-title NSE script](https://nmap.org/nsedoc/scripts/vnc-title.html) - Desktop name/geometry retrieval and intrusion note
- [RFC 6143: The Remote Framebuffer Protocol](https://datatracker.ietf.org/doc/html/rfc6143) - ProtocolVersion handshake and version strings
- [UltraVNC Server Configuration](https://uvnc.com/docs/ultravnc-server/49-ultravnc-server-configuration.html) - Default ports and 5900+display mapping
- [SANS ISC Port 5900](https://isc.sans.edu/port.html?port=5900) - Operational notes on VNC port usage and display mapping