X11

X11 (X Window System) provides the graphical display framework for Unix and Linux systems. X11 servers listen on TCP ports 6000 and above, where port 6000 corresponds to display :0, port 6001 to display :1, and so on. Nmap identifies the service as X11.

An accessible X11 server with weak or disabled access controls allows an attacker to view the target's screen in real time, capture keystrokes (including passwords), take screenshots, and inject keyboard or mouse input. The xhost + misconfiguration, which disables all access restrictions, is still found in practice. X11 forwarding through SSH can also be abused if the forwarded display is accessible to other users on the system.

Enumeration begins with Nmap's x11-access script to check if the X11 server allows unauthenticated connections. When access is granted, xdpyinfo retrieves display information, xwininfo lists open windows, and xwd captures screenshots of individual windows or the entire screen. The xspy tool or xinput can log keystrokes from the remote display. Testing for X11 access is a standard check during local privilege escalation assessments.