Skip to content
HackIndex.io

X11 Open Display Enumeration

2 min read Created Sep 14, 2026 Last updated Sep 14, 2026

X11 (X Window System) listens on TCP port 6000 and up (6000 + display number). An open X server with no access controls allows any network client to connect and interact with the display: capture screenshots, record keystrokes, and inject input. Enumeration confirms whether the display is reachable and whether access controls are disabled.

Port Scanning

X11 uses port 6000 for display :0, 6001 for :1, and so on. Most systems run a single display on 6000.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 6000-6005 $TARGET_IP 
PORT     STATE SERVICE VERSION
6000/tcp open  X11     (access denied)
6001/tcp closed X11:1
Explain command
-p 6000-6005 Scan the common X11 display port range.

"access denied" means the port is open but xhost access control is blocking the connection. An open display shows the X11 version string instead.

Nmap X11 Access Check

The x11-access NSE script tests whether the display allows unauthenticated connections.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 6000 --script x11-access $TARGET_IP 
PORT     STATE SERVICE
6000/tcp open  X11
| x11-access:
|   X11 server access is granted
|_  No authentication required
Explain command
--script x11-access Tests whether the X11 display allows unauthenticated connections.

"access is granted" confirms the display is open. Proceed to exploitation.

Display Information

xdpyinfo queries the X server for version, vendor, screen dimensions, and extensions. Successful output confirms full display access.

┌──(kali㉿kali)-[~]
└─$ xdpyinfo -display $TARGET_IP:0 
name of display:    10.10.14.5:0
version number:    11.0
vendor string:    The X.Org Foundation
vendor release number:    12101004
number of screens:    1

screen #0:
  dimensions:    1920x1080 pixels

Screen dimensions help frame screenshots. The vendor and version identify the X server implementation.

Metasploit Scanner

The open_x11 module scans a range of targets for open X11 displays.

msf6 > use auxiliary/scanner/x11/open_x11
msf6 > set RHOSTS $TARGET_IP
msf6 > run 
[*] $TARGET_IP:6000 - X11 - Open X Server @ $TARGET_IP:6000 (The X.Org Foundation)

If the X server is accessible, continue to X11 session hijacking for screenshot capture, keylogging, and command injection.

References