Brute force is pos­si­ble with nmap: # nmap --script vnc-brute -p 5900 localhost For TightVNC, use vncp­wd to break pass­words. A pass­word can be obtained via reg query HKLM\Software\TightVNC\Server\ /v Password