skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-x11

Tests X11 display servers for unauthenticated access, cookie reuse, keystroke capture, and input injection.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#metasploit#Nmap#x11#network services#xdotool#keylogging
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-x11
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-x11
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-x11
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-x11

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, exposed X Window System (X11) display servers on TCP 6000+ are often misconfigured with open access or reusable MIT-MAGIC-COOKIE-1 tokens, yet testers frequently miss how to turn that access into demonstrated impact like screenshots, clipboard theft, keystroke capture, and command execution.

Core Features & Use Cases

  • Access Detection: Detect unauthenticated ("xhost +") X11 displays using nmap NSE scripts and Metasploit's open_x11 scanner, and confirm access with xdpyinfo and xwininfo.
  • Session Exploitation: Reuse ~/.Xauthority cookies, enumerate windows and clients, sniff keystrokes with xspy, steal clipboard contents with xclip/xsel, and capture screenshots with xwd.
  • Command Execution: Inject keystrokes with xdotool or Metasploit's x11_keyboard_exec to run commands inside the victim's graphical session.
  • Use Case: A tester finds TCP 6000 open on a Linux host, confirms anonymous display access, captures a desktop screenshot revealing a password manager, and injects keystrokes to spawn a reverse shell as proof of impact.

Quick Start

Ask the AI to check whether the X11 display on target IP port 6000 allows unauthenticated access and demonstrate the impact.

Frequently Asked Questions about pentesting-x11

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if an X11 server allows unauthenticated access?▼

Run nmap with the x11-access NSE script against port 6000, or use Metasploit's auxiliary/scanner/x11/open_x11 module. Confirm access when xdpyinfo -display <IP>:0 returns display information without an authentication error.

How to capture keystrokes from a remote X11 session?▼

Use xspy against the target display (e.g., xspy <IP>:0) once you have display access, or monitor input events with xinput --test_xi2. This captures keystrokes typed in the victim's session, including passwords.

Can I reuse an Xauthority cookie to access an X11 display?▼

Yes, the MIT-MAGIC-COOKIE-1 token in ~/.Xauthority grants full display access. Set the XAUTHORITY environment variable to the cookie file path and run xdpyinfo or xwininfo to connect, even via the local Unix socket when TCP 6000 is closed.

Why does XSendEvent keystroke injection fail on some windows?▼

Many applications ignore synthetic events sent directly to a specific window via XSendEvent. Activate the target window first with xdotool windowactivate, then send normal key events, which applications process reliably.

What port does X11 use and how are display numbers mapped?▼

X11 listens on TCP port 6000 plus the display number, so display :0 is port 6000 and :1 is 6001. Locally it also uses the Unix socket /tmp/.X11-unix/X<display>, reachable with a valid cookie even when TCP is disabled.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
dieu-donneedieu-donnee

security-reviewer

Identify security vulnerabilities in code and infrastructure with severity-rated audit reports.

Community
Advanced
alfredhuang211alfredhuang211

ssh-to-linux-host

Connect to remote Linux hosts via SSH to run commands and transfer files.

Community
Advanced
agent0aiagent0ai
19.1k

host-computer-use-windows

Guides Windows UI Automation targeting for remote computer-use sessions.

Official
Intermediate