VNC:
Enumeration
VNC discovery, auth probing, version fingerprinting, default creds
VNC enumeration identifies the server implementation, authentication requirements, and desktop environment before attempting access. Connecting to port 5900 (or 5900+display number) returns the RFB protocol version and the authentication types the server supports: None (no auth), VNC password, or tighter mechanisms like TLS or Unix credentials.
Nmap's vnc-info script extracts the server version, desktop name, and screen dimensions. The desktop name often reveals the hostname, logged-in user, or OS. Screenshot capture with tools like vncsnapshot or nmap's vnc-screenshot script (when authentication is not required) gives you a visual of what is running without interacting with the session.
Multiple VNC implementations exist (RealVNC, TightVNC, TigerVNC, UltraVNC, x11vnc) and each has different security defaults and vulnerability profiles. Identifying the exact implementation guides your exploitation approach. Check for VNC on non-standard ports too, as administrators sometimes run it on high ports hoping obscurity provides security.