VNC Honeypot Enterprise Community
The VNC service emulates a VNC server (RFB protocol) and captures authentication attempts.
Configuration
json
"vnc": [
{
"port": 5900,
"version": "RFB_38"
}
]Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
port | integer | 5900 | TCP port |
version | string | RFB_38 | RFB protocol version string |
Protocol versions
| Value | Protocol string |
|---|---|
RFB_33 | RFB 003.003 |
RFB_37 | RFB 003.007 |
RFB_38 | RFB 003.008 (default) |
What gets captured
| Event | Fields |
|---|---|
| Connection made | Source IP and port |
| Data sent | Raw RFB bytes |
| Login attempt | Challenge and response (hex-encoded VNC auth exchange - not plaintext password) |