@@ -319,9 +319,9 @@ Inter-scan wait: 29s (target ~256 hosts)
 
 When `script_scan` is enabled, nmap runs targeted NSE scripts against relevant ports. Scripts are chosen based on scan type (External vs Internal):
 
-**External scans** run: `ftp-anon`, `ssh-auth-methods`, `ssh2-enum-algos`, `*-ntlm-info`, `ssl-cert`, `ms-sql-ntlm-info`, `rdp-ntlm-info`, `docker-version`, `snmp-brute`, `snmp-sysdescr`, `ajp-headers`, `x11-access`, `dameware-detect` (custom, 6129), `cucm-detect` (custom, 6970), `ipmi-version`, `ipmi-cipher-zero`, `ipmi-hashdump` (custom, U:623), `ike-version` (U:500), `openvpn-detect` (custom, U:1194/1194), `vnc-info`, `realvnc-auth-bypass` (5900, 5901), `ollama-detect` (custom, 11434), `openai-api-detect` (custom, 1234/1337/3000/8000), `gradio-detect` (custom, 7860), `koboldcpp-detect` (custom, 5001)
+**External scans** run: `ftp-anon`, `ssh-auth-methods`, `ssh2-enum-algos`, `*-ntlm-info`, `ssl-cert`, `ms-sql-ntlm-info`, `rdp-ntlm-info`, `docker-version`, `snmp-brute`, `snmp-sysdescr`, `ajp-headers`, `x11-access`, `dameware-detect` (custom, 6129), `cucm-detect` (custom, 6970), `ipmi-version`, `ipmi-cipher-zero`, `ipmi-hashdump` (custom, U:623), `ike-version` (U:500), `openvpn-detect` (custom, U:1194/1194), `vnc-info`, `realvnc-auth-bypass`, `vnc-title` (5900, 5901), `ollama-detect` (custom, 11434), `openai-api-detect` (custom, 1234/1337/3000/8000), `gradio-detect` (custom, 7860), `koboldcpp-detect` (custom, 5001)
 
-**Internal scans** run: `ftp-anon`, `rpcinfo`, `nfs-showmount`, `nfs-ls`, `smb-security-mode`, `smb2-security-mode`, `smb-vuln-ms17-010`, `smb-vuln-ms08-067`, `smb-double-pulsar-backdoor`, `smb-vuln-cve-2017-7494`, `rmi-dumpregistry`, `ms-sql-info`, `docker-version`, `snmp-brute`, `snmp-sysdescr`, `ajp-headers`, `x11-access`, `jdwp-info` (5005), `http-title` (8001), `banner` (61616), `dameware-detect` (custom, 6129), `cucm-detect` (custom, 6970), `nodejs-inspector` (custom, 9229), `kubelet-anon-check` (custom, 10250), `delve-debugger` (custom, 2345), `ipmi-version`, `ipmi-cipher-zero`, `ipmi-hashdump` (custom, U:623), `ike-version` (U:500), `openvpn-detect` (custom, U:1194/1194), `vnc-info`, `realvnc-auth-bypass` (5900, 5901), `ollama-detect` (custom, 11434), `openai-api-detect` (custom, 1234/1337/3000/8000), `gradio-detect` (custom, 7860), `koboldcpp-detect` (custom, 5001)
+**Internal scans** run: `ftp-anon`, `rpcinfo`, `nfs-showmount`, `nfs-ls`, `smb-security-mode`, `smb2-security-mode`, `smb-vuln-ms17-010`, `smb-vuln-ms08-067`, `smb-double-pulsar-backdoor`, `smb-vuln-cve-2017-7494`, `rmi-dumpregistry`, `ms-sql-info`, `docker-version`, `snmp-brute`, `snmp-sysdescr`, `ajp-headers`, `x11-access`, `jdwp-info` (5005), `http-title` (8001), `banner` (61616), `dameware-detect` (custom, 6129), `cucm-detect` (custom, 6970), `nodejs-inspector` (custom, 9229), `kubelet-anon-check` (custom, 10250), `delve-debugger` (custom, 2345), `ipmi-version`, `ipmi-cipher-zero`, `ipmi-hashdump` (custom, U:623), `ike-version` (U:500), `openvpn-detect` (custom, U:1194/1194), `vnc-info`, `realvnc-auth-bypass`, `vnc-title` (5900, 5901), `ollama-detect` (custom, 11434), `openai-api-detect` (custom, 1234/1337/3000/8000), `gradio-detect` (custom, 7860), `koboldcpp-detect` (custom, 5001)
 
 Port 9100 (JetDirect raw printing protocol) is included in the Specialized category. Hosts with port 9100 open are identified as printers; SNMP default community string and anonymous FTP findings are suppressed for these hosts to reduce noise.
 
@@ -382,6 +382,7 @@ After scanning, `generate_findings()` parses all nmap XML results and produces s
 | LOW | OpenVPN Service Detected (U:1194/1194; identification only — VPN exposure is expected, no "exposed externally" finding is raised) |
 | LOW | SQL Server instance discovered |
 | LOW | WSUS Service Detected (8530/8531; identification only — review CVE-2025-59287 patch status) |
+| LOW | VNC Desktop Name Disclosed (5900/5901, retrieved by `vnc-title` without credentials) |
 
 On Internal scans, if `ms-sql-info` discovers SQL Server named instances on non-standard ports, nmap is automatically re-run against those ports.
 
@@ -412,7 +413,7 @@ On External scans, each externally-exposed sensitive service is additionally vul
 | U:500 | IKE/IPsec VPN | Aggressive Mode + PSK auto-detected (HIGH); ike-version identifies vendor/mode |
 | U:1194, 1194 | OpenVPN | Custom NSE (`openvpn-detect`) completes the P_CONTROL_HARD_RESET handshake to confirm the protocol over UDP or TCP; identification only (LOW) — no version is disclosed pre-auth, and no "exposed externally" finding is raised since VPN reachability is expected. Servers using `tls-auth`/`tls-crypt` silently drop the probe and read as no match |
 | U:623 | IPMI / BMC | Cipher Zero auth bypass auto-detected (CRITICAL); RAKP hash disclosure for offline crack (HIGH, CVE-2013-4786) |
-| 5900, 5901 | VNC | No-auth auto-detected (CRITICAL); realvnc-auth-bypass checked (HIGH) |
+| 5900, 5901 | VNC | No-auth auto-detected (CRITICAL); realvnc-auth-bypass checked (HIGH); desktop name retrieved via vnc-title (LOW) |
 | 11434 | Ollama LLM Runtime | Custom NSE (`ollama-detect`) probes `/api/tags` and `/api/version`; unauthenticated access exposes model inventory and full inference API |
 | 1234, 1337 | LM Studio / OpenAI-compat API | Custom NSE (`openai-api-detect`) probes `/v1/models`; unauthenticated access exposes models and inference |
 | 3000, 8000 | OpenAI-compatible LLM API | Custom NSE (`openai-api-detect`) probes `/v1/models` with three-string fingerprint to avoid false positives on generic web apps |
@@ -441,4 +442,4 @@ On External scans, each externally-exposed sensitive service is additionally vul
 - **ActiveMQ (61616)** — [CVE-2023-46604 PoC](https://github.com/X1r0z/ActiveMQ-RCE) · [Rapid7 module](https://www.rapid7.com/db/modules/exploit/multi/misc/apache_activemq_rce_cve_2023_46604)
 - **IKE/IPsec (U:500)** — [ike-version NSE](https://nmap.org/nsedoc/scripts/ike-version.html) · ike-scan --aggressive for hash capture · hashcat mode 5300 (IKEv1) / 5400 (IKEv2)
 - **IPMI (U:623)** — [US-CERT TA13-207A](https://www.cisa.gov/news-events/alerts/2013/07/26/risks-using-intelligent-platform-management-interface-ipmi) · [hashcat mode 7300](https://hashcat.net/wiki/doku.php?id=hashcat)
-- **VNC (5900/5901)** — [CVE-2006-2369](https://nvd.nist.gov/vuln/detail/CVE-2006-2369) · [vnc-info NSE](https://nmap.org/nsedoc/scripts/vnc-info.html)
+- **VNC (5900/5901)** — [CVE-2006-2369](https://nvd.nist.gov/vuln/detail/CVE-2006-2369) · [vnc-info NSE](https://nmap.org/nsedoc/scripts/vnc-info.html) · [vnc-title NSE](https://nmap.org/nsedoc/scripts/vnc-title.html)
@@ -1943,7 +1943,7 @@ def _build_nmap_cmd(dest_port, input_file, output_file, source_port,
             dest_port[2:] if 'U:' in dest_port else dest_port,
             '--open', '--randomize-hosts',
         ]
-        if source_port and dest_port not in _SMB_PORTS:
+        if source_port and dest_port not in _MULTI_SCRIPT_PORTS:
             cmd += ['--source-port', source_port]
         cmd += ['-iL', input_file, '-oX', output_file]
         scripts = _get_scripts_for_port(dest_port, target_scan)
@@ -1974,8 +1974,9 @@ def _build_nmap_cmd(dest_port, input_file, output_file, source_port,
             '-Pn', '-p', dest_port,
             '--open', '--randomize-hosts',
         ]
-        # Skip --source-port for SMB when scripts run to avoid 4-tuple collision
-        if source_port and not (script_scan and dest_port in _SMB_PORTS):
+        # Skip --source-port on multi-script ports when scripts run, to avoid
+        # 4-tuple collision between concurrent NSE connections
+        if source_port and not (script_scan and dest_port in _MULTI_SCRIPT_PORTS):
             cmd += ['--source-port', source_port]
 
     cmd += ['-iL', input_file, '-oX', output_file]
@@ -2458,8 +2459,8 @@ def lineCount(file):
     'U:500': 'ike-version',
     'U:1194': f'{_DIR}/nse/openvpn-detect.nse',
     '1194':  f'{_DIR}/nse/openvpn-detect.nse',
-    '5900':  'vnc-info,realvnc-auth-bypass',
-    '5901':  'vnc-info,realvnc-auth-bypass',
+    '5900':  'vnc-info,realvnc-auth-bypass,vnc-title',
+    '5901':  'vnc-info,realvnc-auth-bypass,vnc-title',
     '631':   f'{_DIR}/nse/cups-browsed-rce.nse',
     'U:631': f'{_DIR}/nse/cups-browsed-rce.nse',
     '8530':  f'{_DIR}/nse/wsus-detect.nse',
@@ -2512,8 +2513,8 @@ def lineCount(file):
     'U:500': 'ike-version',
     'U:1194': f'{_DIR}/nse/openvpn-detect.nse',
     '1194':  f'{_DIR}/nse/openvpn-detect.nse',
-    '5900':  'vnc-info,realvnc-auth-bypass',
-    '5901':  'vnc-info,realvnc-auth-bypass',
+    '5900':  'vnc-info,realvnc-auth-bypass,vnc-title',
+    '5901':  'vnc-info,realvnc-auth-bypass,vnc-title',
     '631':   f'{_DIR}/nse/cups-browsed-rce.nse',
     'U:631': f'{_DIR}/nse/cups-browsed-rce.nse',
     '8530':  f'{_DIR}/nse/wsus-detect.nse',
@@ -2528,10 +2529,17 @@ def lineCount(file):
     '8000':  f'{_DIR}/nse/openai-api-detect.nse',
 }
 
-# Ports that use multiple concurrent NSE scripts; omit --source-port to prevent
-# TCP 4-tuple collision when nsock opens parallel connections to the same target.
 _SMB_PORTS = frozenset({'139', '445'})
 
+# Ports whose NSE scripts run concurrently against the same service; omit
+# --source-port for these to prevent TCP 4-tuple collision when nsock opens
+# parallel connections to the same target — with a fixed source port every
+# script connects from the same (src, dst) tuple and all but one fail silently.
+# VNC has three portrule scripts (vnc-info, realvnc-auth-bypass, vnc-title),
+# each opening its own RFB connection; for vnc-title a lost connection reads as
+# "no desktop name" rather than as an error.
+_MULTI_SCRIPT_PORTS = _SMB_PORTS | frozenset({'5900', '5901'})
+
 # Windows SMB ports are always co-resident; merge their live hosts after scanning
 # so a missed SYN-ACK on one port does not suppress nmap SMB script checks.
 _SMB_COUPLED_PORTS = ('139', '445')
@@ -3505,6 +3513,23 @@ def port_str_from_fname(fname):
                             'The VNC server accepts connections with no password (security type "None"). '
                             'Any client can view and control the desktop without credentials.')
 
+                # ── vnc-title (desktop name via no-auth or bypassed login) ────
+                # vnc-title only produces a name once it is actually logged in —
+                # via security type None or the realvnc-auth-bypass flaw, since
+                # vnc-brute is not run — so any name is corroboration of the
+                # CRITICAL/HIGH above plus the identity of the exposed desktop.
+                if 'vnc-title' in scripts:
+                    # Success is a multi-line table (name/geometry/color_depth);
+                    # every failure path returns stdnse.format_output(false, ...),
+                    # which renders as "ERROR: ...".  Collapse the whitespace so
+                    # the detail stays on one line in findings.txt.
+                    out = ' '.join(scripts['vnc-title'].split())
+                    if out and not out.upper().startswith('ERROR'):
+                        add('LOW', ip, port_str,
+                            'VNC Desktop Name Disclosed',
+                            f'{out[:200]} — read without supplying credentials, '
+                            'so this desktop session is reachable unauthenticated.')
+
                 # ── realvnc-auth-bypass (CVE-2006-2369) ──────────────────────
                 if 'realvnc-auth-bypass' in scripts:
                     out = scripts['realvnc-auth-bypass']
@@ -4240,6 +4265,14 @@ def _write_artifact(path, content):
         return False
 
 
+# Findings whose detail string differs per host, so findings.txt must print it
+# alongside each host instead of collapsing the group to one description.
+_PER_HOST_DETAIL_TITLES = frozenset({
+    'Service Exposed Externally',
+    'VNC Desktop Name Disclosed',
+})
+
+
 def _write_findings_txt(output_path, target_scan, findings):
     today = datetime.date.today()
     lines = [
@@ -4277,9 +4310,10 @@ def _write_findings_txt(output_path, target_scan, findings):
             repro = _FINDING_REPRO.get(title, {})
             lines.append(f'  [{title}]  port {port_str}')
             lines.append(f'  Affected hosts ({len(hosts)}):')
-            if title == 'Service Exposed Externally':
-                # Detail (exposure label + embedded per-host vuln check) varies per
-                # host, so render it inline rather than collapsing to one line.
+            if title in _PER_HOST_DETAIL_TITLES:
+                # Detail varies per host (exposure label + embedded vuln check;
+                # the VNC desktop name), so render it inline rather than
+                # collapsing the group to one shared description.
                 for h, d in sorted(grp['host_details']):
                     lines.append(f'{h}  —  {d}')
             else:
 
@@ -7472,7 +7472,7 @@ def test_no_wsus_finding_without_script_output(self, nmap_dir):
 
 
 class TestVNCFindings:
-    """VNC findings from vnc-info and realvnc-auth-bypass scripts."""
+    """VNC findings from vnc-info, realvnc-auth-bypass and vnc-title scripts."""
 
     def test_vnc_no_auth_critical(self, nmap_dir):
         """vnc-info output with security type None -> CRITICAL finding."""
@@ -7532,6 +7532,84 @@ def test_vnc_on_port_5901(self, nmap_dir):
         assert 'CRITICAL' in content
         assert '10.0.2.5' in content
 
+    def test_vnc_title_output_low_finding(self, nmap_dir):
+        """vnc-title returning a desktop name -> LOW finding carrying the name."""
+        xml = _nmap_xml(
+            '10.0.2.6', 'tcp', '5900',
+            scripts={'vnc-title': '\n  name: root\'s X desktop (kiosk01:0)'
+                                  '\n  geometry: 1024 x 768\n  color_depth: 24'})
+        (nmap_dir / 'nse_results' / 'port5900.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'External')
+        content = (nmap_dir / 'findings.txt').read_text()
+        assert 'VNC Desktop Name Disclosed' in content
+        assert 'LOW' in content
+        assert '10.0.2.6' in content
+        assert 'kiosk01:0' in content
+        # Multi-line NSE table must be collapsed to one line in findings.txt
+        assert 'color_depth: 24' in content
+        for line in content.splitlines():
+            if 'kiosk01:0' in line:
+                assert 'geometry: 1024 x 768' in line
+
+    def test_vnc_title_on_port_5901(self, nmap_dir):
+        """vnc-title finding also fires on 5901 and on Internal scans."""
+        xml = _nmap_xml(
+            '10.0.2.7', 'tcp', '5901',
+            scripts={'vnc-title': '\n  name: build-agent\n  geometry: 800 x 600'})
+        (nmap_dir / 'nse_results' / 'port5901.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'Internal')
+        content = (nmap_dir / 'findings.txt').read_text()
+        assert 'VNC Desktop Name Disclosed' in content
+        assert '10.0.2.7' in content
+
+    def test_vnc_title_blank_output_no_finding(self, nmap_dir):
+        """Whitespace-only vnc-title output -> no finding."""
+        xml = _nmap_xml('10.0.2.8', 'tcp', '5900', scripts={'vnc-title': '   \n  '})
+        (nmap_dir / 'nse_results' / 'port5900.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'External')
+        findings_file = nmap_dir / 'findings.txt'
+        if findings_file.exists():
+            assert 'VNC Desktop Name Disclosed' not in findings_file.read_text()
+
+    def test_vnc_title_error_output_no_finding(self, nmap_dir):
+        """vnc-title ERROR output (login failed) -> no finding."""
+        xml = _nmap_xml(
+            '10.0.2.9', 'tcp', '5900',
+            scripts={'vnc-title': "ERROR: Couldn't log in: Authentication failed"})
+        (nmap_dir / 'nse_results' / 'port5900.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'External')
+        findings_file = nmap_dir / 'findings.txt'
+        if findings_file.exists():
+            assert 'VNC Desktop Name Disclosed' not in findings_file.read_text()
+
+
+class TestVNCTitleScriptWiring:
+    """vnc-title is mapped to 5900/5901 and does not collide on --source-port."""
+
+    @pytest.mark.parametrize('port', ['5900', '5901'])
+    @pytest.mark.parametrize('scan', ['External', 'Internal'])
+    def test_vnc_title_mapped_both_scans(self, port, scan):
+        scripts = _get_scripts_for_port(port, scan).split(',')
+        assert 'vnc-title' in scripts
+        assert 'vnc-info' in scripts
+        assert 'realvnc-auth-bypass' in scripts
+
+    @pytest.mark.parametrize('port', ['5900', '5901'])
+    def test_vnc_script_pass_omits_source_port(self, port):
+        """Three concurrent RFB scripts on one port must not share a 4-tuple."""
+        cmd = _build_nmap_cmd(port, '/in.txt', '/out.xml', '53',
+                              script_scan=True, target_scan='External',
+                              script_only=True)
+        assert '--source-port' not in cmd
+        assert 'vnc-title' in cmd[cmd.index('--script') + 1]
+
+    @pytest.mark.parametrize('port', ['5900', '5901'])
+    def test_vnc_banner_pass_keeps_source_port(self, port):
+        """Banner pass runs no scripts, so the source port is still usable."""
+        cmd = _build_nmap_cmd(port, '/in.txt', '/out.xml', '53',
+                              script_scan=False, target_scan='External')
+        assert '--source-port' in cmd
+
 
 class TestIKEFindings:
     """IKE findings from ike-version script on U:500."""