--- nmap/scripts/x11-access.nse	2012-01-07 20:06:05.596396568 +0100
+++ x11-access-vendor.nse	2012-01-07 20:13:19.612406883 +0100
@@ -15,9 +15,12 @@
 ---
 -- @output
 -- Host script results:
--- |_ x11-access: X server access is granted
+-- |_ x11-access: X server access is granted, Vendor: somevendor
 
-author = "vladz"
+author = [[
+Scriptauthor: vladz
+Vendorcheck: Per-Erik Persson
+]]
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
 categories = {"default", "safe", "auth"}
 
@@ -53,16 +56,20 @@
         -- the success field of this structure (stored on 1 byte) is not
         -- equal to xTrue [2]. For more information, see the Xlib
         -- programming Manual [3].
+        -- Vendorname is located at pos 40
         --
         -- [1] xConnSetupPrefix structure is defined in X11/Xproto.h.
         -- [2] xTrue = 0x01 according to X11/Xproto.h.
         -- [3] http://www.sbin.org/doc/Xlib
 
-        result = try(socket:receive_bytes(1))
+        result = try(socket:receive())
+        local pos, access = bin.unpack('H', result, 1)
         socket:close()
 
         -- Check if first byte received is 0x01 (xTrue: succeed).
-        if string.match(result, "^\001") then
+        if access then
+                -- Extract the vendor of the Xserver if access is allowed.
+                local pos, xserverstring = bin.unpack('z', result, 41)
                 return "X server access is granted"
         end
 end