# X11 Open Display Enumeration

> Enumerate exposed X11 displays accepting unauthenticated connections, identify open DISPLAY targets, and assess remote screen access via xauth and xdpyinfo.

- **URL:** https://hackindex.io/services/x11/enumeration/x11-open-display-enumeration
- **Path:** X11 > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/x11/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

X11 (X Window System) listens on TCP port 6000 and up (6000 + display number). An open X server with no access controls allows any network client to connect and interact with the display: capture screenshots, record keystrokes, and inject input. Enumeration confirms whether the display is reachable and whether access controls are disabled.

## Port Scanning

X11 uses port 6000 for display `:0`, 6001 for `:1`, and so on. Most systems run a single display on 6000.

```bash
nmap -sV -p 6000-6005 $TARGET_IP
# PORT     STATE SERVICE VERSION
# 6000/tcp open  X11     (access denied)
# 6001/tcp closed X11:1
```

## Nmap X11 Access Check

The `x11-access` NSE script tests whether the display allows unauthenticated connections.

```bash
nmap -sV -p 6000 --script x11-access $TARGET_IP
# PORT     STATE SERVICE
# 6000/tcp open  X11
# | x11-access:
# |   X11 server access is granted
# |_  No authentication required
```

## Display Information

`xdpyinfo` queries the X server for version, vendor, screen dimensions, and extensions. Successful output confirms full display access.

```bash
xdpyinfo -display $TARGET_IP:0
# name of display:    10.10.14.5:0
# version number:    11.0
# vendor string:    The X.Org Foundation
# vendor release number:    12101004
# number of screens:    1
#
# screen #0:
#   dimensions:    1920x1080 pixels
```

## Metasploit Scanner

The `open_x11` module scans a range of targets for open X11 displays.

```bash
use auxiliary/scanner/x11/open_x11
set RHOSTS $TARGET_IP
run
# [*] $TARGET_IP:6000 - X11 - Open X Server @ $TARGET_IP:6000 (The X.Org Foundation)
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam.

If the X server is accessible, continue to [X11 session hijacking](https://hackindex.io/services/x11/exploitation/x11-session-hijacking) for screenshot capture, keylogging, and command injection.

## References

- [Nmap: x11-access NSE Script](https://nmap.org/nsedoc/scripts/x11-access.html) - Checks whether the X server allows unauthenticated connections.
- [HackTricks: 6000 Pentesting X11](https://hacktricks.wiki/en/network-services-pentesting/6000-pentesting-x11.html) - X11 enumeration and exploitation reference.