pentesting-x11

name	pentesting-x11
description	Testing the X Window System (X11) display server during authorized engagements. X11 listens on TCP 6000+<display> and the local Unix socket /tmp/.X11-unix/X<display>. Covers detecting unauthenticated ("xhost +") access with nmap NSE and Metasploit, abusing MIT-MAGIC-COOKIE-1 auth tokens from ~/.Xauthority, window/clipboard enumeration, keystroke sniffing (xspy), screenshotting (xwd), live shadowing, and keystroke injection (xdotool) for command execution.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","x11","linux","keylogging","remote-desktop"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting X11 (port 6000)

When to Use

• During authorized assessments when TCP 6000+ is open (X11 display server)
• When testing for unauthenticated X11 access (xhost + style misconfiguration)
• When you have a local foothold and can read a valid ~/.Xauthority cookie
• When you want screenshots, clipboard contents, keystroke capture, or input injection from an X session
• When pivoting from a captured display to command execution on the host

Quick Enumeration

# Check for anonymous (open) X11 access
nmap -sV --script x11-access -p 6000 <IP>
msf> use auxiliary/scanner/x11/open_x11

# Local triage (post-foothold) — find DISPLAY and cookie
echo "$DISPLAY"
ls -lah /tmp/.X11-unix/
ps -efww | grep -E '[X]org|[X]wayland'      # look for -auth <file> in cmdline
xauth info
xauth list

# Shodan-style discovery
# port:6000 x11

Critical: Checks Most Often Missed

1. Open X11 (no auth) — xhost + or open access control lets any host connect to display :0 with no token. Confirm with x11-access / open_x11, then enumerate windows directly.
2. MIT-MAGIC-COOKIE-1 reuse — the 128-bit cookie in ~/.Xauthority is sent in plaintext and grants full access. If you can read the file (or another user's), export XAUTHORITY=/path/to/.Xauthority and connect.
3. Cookie via Xorg -auth argument — the X server's command line often reveals the authoritative auth file path (ps -efww | grep Xorg), readable with sufficient privileges.
4. Access ≠ "just graphics" — a connected display enables window enumeration, clipboard theft, screenshots, keystroke sniffing, and input injection (effectively RCE in the user's session).
5. Unix socket foothold — even when 6000/tcp is closed, a local foothold + valid cookie abuses /tmp/.X11-unix/X<display>.
6. XSendEvent ignored — apps often drop injected events sent to a specific window; activate the window first, then inject normal key events for reliability.