Skip to main content
Default Port: 79 Finger is one of the oldest protocols still occasionally found in the wild, built in 1971 to answer a simple question: who’s logged into this machine, and who are they? It’s rare on modern networks, but where it does turn up it’s almost always worth the effort, usernames leak directly, and the protocol’s legacy, minimally validated parsing occasionally allows outright command injection.

User Enumeration

Finger’s entire purpose is answering “who is this user”, which makes it a direct username oracle with zero authentication required.

Command Injection

Some finger daemon implementations pass the query almost unvalidated to a shell, turning a username lookup into command execution.
Finger is plaintext and human-readable, a raw nc connection with a hand-typed query works exactly the same as any dedicated client. Useful when you don’t have the finger binary installed.

​
Basic Queries

The same queries work directly over a raw connection, useful when the finger client isn’t available:
A completely empty query asks for every currently logged-in user:
/W requests the long-format listing, if the daemon supports it:

​
Nmap Enumeration

​
User Enumeration at Scale

A single query confirms one username at a time, which is fine for a quick check but not for testing a wordlist. finger-user-enum from pentestmonkey automates that.
Checking one username across many hosts works the same way with the arguments swapped:

​
Command Injection

Not every finger daemon is vulnerable to this, it depends entirely on how the implementation handles the query string. Confirm the response actually reflects command output before treating this as a working technique.
Some finger daemons pass the query string close to verbatim into a shell call, which means a query starting with a pipe can execute arbitrary commands instead of looking up a user.
If the response reflects command output rather than a “user not found” error, the injection worked.

​
Finger Bounce

Much like an FTP bounce, a finger query can sometimes be relayed through one host to query a second host, letting you reach a target indirectly through a host you already have access to.
This asks 10.0.0.1 to finger root on 10.0.0.2 on your behalf, useful for reaching a host that isn’t directly accessible to you but is to the relay.
finger-user-enum supports this relay behavior natively with the -r flag, rather than needing to craft the raw query by hand.

​
Windows: Finger as a Text Transfer Channel

This isn’t exploiting finger itself, it’s abusing the fact that finger is a built-in Windows command that can fetch arbitrary attacker-controlled text, useful for getting a stager onto a host where more obvious download tools are blocked or monitored.
Piped directly into PowerShell, this becomes a way to execute a remotely-hosted stager without ever touching Invoke-WebRequest or certutil, both of which are watched far more closely:

​
Quick Reference Tools

HackTricks: Finger

Deeper breakdown of Finger enumeration and exploitation techniques.
Finger exposes real usernames with no authentication. Even where command injection isn’t possible, confirmed usernames feed directly into password spraying elsewhere, treat the enumeration itself as a meaningful finding.