Tasks#
Battle drills for the operator’s graphical session. Trigger to response, no narration.
Which display server am I on?
$ echo "$XDG_SESSION_TYPE $WAYLAND_DISPLAY $DISPLAY"
$ loginctl show-session $(loginctl | awk '/'$USER'/{print $1}') -p Type
Which window manager / compositor / DE is running?
$ echo "$XDG_CURRENT_DESKTOP / $DESKTOP_SESSION"
$ pgrep -af 'gnome-shell|kwin|mutter|sway|hyprland|river|i3|dwm|bspwm|xfwm4|awesome|xmonad|qtile|openbox|niri'
List every visible window and its PID.
$ wmctrl -lp # X11
$ swaymsg -t get_tree | jq '..|select(.pid?)|{name,pid,app_id}' # sway
$ hyprctl clients # hyprland
Close X11’s TCP attack surface (X11 only).
$ ss -ltnp | grep -E ':60[0-9]{2}' # any hit = listening
$ xhost # any '+' line is a hole
# disable: edit /etc/X11/xinit/xserverrc to include -nolisten tcp
Audit autostart entries (persistence triage).
$ ls -1 ~/.config/autostart/ /etc/xdg/autostart/
$ systemctl --user list-units --state=running
Clipboard, in and out.
$ xclip -selection clipboard -o # X11 read
$ echo hello | xclip -selection clipboard # X11 write
$ wl-paste # Wayland read
$ echo hello | wl-copy # Wayland write
Screenshot from the command line.
$ scrot screen.png # X11
$ grim -g "$(slurp)" region.png # wlroots Wayland
$ gnome-screenshot -f screen.png # GNOME via portal
Lock the session.
$ loginctl lock-session
$ swaylock -f # Sway
$ hyprlock # Hyprland
$ xdg-screensaver lock # generic X11
Kill the keylogger surface (X11 only, paranoid mode).
# Migrate to a Wayland session at the display manager.
# If forced to stay on X11, disable xtest extension:
$ Xorg -extension XTEST # next session boot