# X11

> X11 is a display server protocol. Attackers probe open ports, check for auth bypass, capture keystrokes or screenshots, pivot via display access, and maintain persistence through xhost misconfigs

- **URL:** https://hackindex.io/services/x11
- **Type:** Service
- **Default ports:** 6000, 6063
- **Tags:** x11, linux, display, remote-access, gui, unix
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

X11 (X Window System) provides the graphical display framework for Unix and Linux systems. X11 servers listen on **TCP ports 6000 and above**, where port 6000 corresponds to display `:0`, port 6001 to display `:1`, and so on. Nmap identifies the service as `X11`.

An accessible X11 server with weak or disabled access controls allows an attacker to view the target's screen in real time, capture keystrokes (including passwords), take screenshots, and inject keyboard or mouse input. The `xhost +` misconfiguration, which disables all access restrictions, is still found in practice. X11 forwarding through SSH can also be abused if the forwarded display is accessible to other users on the system.

Enumeration begins with Nmap's `x11-access` script to check if the X11 server allows unauthenticated connections. When access is granted, `xdpyinfo` retrieves display information, `xwininfo` lists open windows, and `xwd` captures screenshots of individual windows or the entire screen. The `xspy` tool or `xinput` can log keystrokes from the remote display. Testing for X11 access is a standard check during local privilege escalation assessments.

## Phases

- [Enumeration](https://hackindex.io/services/x11/enumeration.md): Guides for finding open X11 displays and confirming unauth access (1 guides)
- [Exploitation](https://hackindex.io/services/x11/exploitation.md): Hijack X11 displays to capture screens and inject shells (1 guides)