skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-vnc

Tests VNC remote desktop services for authentication weaknesses during authorized penetration tests.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#brute force#metasploit#Nmap#remote desktop#VNC#rfb protocol
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-vnc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-vnc
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-vnc
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-vnc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

VNC servers frequently expose unauthenticated access, weak 8-character passwords, and known authentication bypass flaws, but testers often miss these checks or lack a structured workflow for validating them during authorized engagements.

Core Features & Use Cases

  • RFB Fingerprinting: Enumerate RFB protocol versions, security types, and desktop titles using nmap NSE scripts like vnc-info, vnc-title, and realvnc-auth-bypass.
  • Authentication Testing: Detect no-auth (None security type) access with Metasploit's vnc_none_auth, flag RealVNC auth bypasses, and brute force passwords with vnc_login or hydra.
  • Password Recovery: Decrypt the weak 3DES-stored credentials in ~/.vnc/passwd files using vncpwd to recover cleartext passwords.
  • Use Case: During an authorized internal assessment, you discover port 5901 open on a host. Use this Skill to confirm the server accepts the None security type, connect with vncviewer for full desktop control, and document the finding with a structured report.

Quick Start

Test the VNC service on the target host at 192.168.1.10 port 5901 for unauthenticated access and weak passwords, then report any findings.

Frequently Asked Questions about pentesting-vnc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test VNC for unauthenticated access?▼

Use Metasploit's auxiliary/scanner/vnc/vnc_none_auth module against the target to check whether the server accepts the None security type. If it does, connect directly with vncviewer <IP>::5901 to gain desktop access without credentials.

How to brute force a VNC password with hydra or Metasploit?▼

Run hydra -P passwords.txt <IP> vnc or Metasploit's auxiliary/scanner/vnc/vnc_login module with a wordlist. Note that VNC passwords are truncated to 8 characters, so common-password lists are often effective.

How do I decrypt a VNC passwd file?▼

Use the vncpwd tool to recover the cleartext password from a ~/.vnc/passwd file. VNC stores passwords encrypted with a fixed, publicly reversed 3DES key, so any readable passwd file yields the cleartext.

What nmap scripts detect VNC vulnerabilities?▼

Run nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title against ports 5900/5901. vnc-info reports the RFB version and security types, vnc-title grabs the desktop title, and realvnc-auth-bypass flags the known RealVNC authentication bypass.

Why is VNC limited to 8-character passwords?▼

The VNC authentication protocol uses a DES challenge-response that truncates passwords to 8 characters by design. This limitation makes VNC passwords inherently weak against brute force attacks.

When should VNC testing not be performed?▼

Only test VNC services during authorized engagements with explicit permission. Unauthenticated access grants full keyboard and mouse control of a live desktop, which can disrupt the logged-in user's session and expose sensitive on-screen data.

Related Skills

Explore More Software Engineering Skills→
duriandurinoduriandurino

enum

Discover live hosts and enumerate open ports and services with nmap, gobuster, feroxbuster, and ffuf.

Community
Intermediate
jokken79jokken79
1

Windows Privilege Escalation

Enumerate Windows systems and identify privilege escalation vectors during authorized penetration testing.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

remote-access-enumeration

Enumerate FTP, SSH, RDP, VNC, and WinRM services on target hosts.

Official
Intermediate
starwreckntxstarwreckntx

Exploit Development Agent

Develop exploits and generate payloads for authorized red-team engagements.

Community
Basic