Finger

Finger runs on TCP port 79 and provides user information on Unix-like systems. Nmap identifies it as finger. The protocol is mostly obsolete but still shows up on legacy systems and older Solaris, BSD, or Linux installations.

Finger exposes usernames, login times, idle times, home directories, and sometimes plan files. This information directly supports brute-force and social engineering attacks. Some implementations allow enumeration of all logged-in users or even all accounts on the system.

Query the service with finger @target to list logged-in users, or finger username@target for details on a specific account. The finger-user-enum script from pentestmonkey and Nmap's finger NSE scripts automate username enumeration.