Skip to content
HackIndex logo

HackIndex

Finger User Enumeration

2 min read Mar 29, 2026

Finger on port 79 leaks detailed user information on older Unix/Linux systems. Valid responses confirm usernames and expose GECOS fields, home directories, shells, last logins, and idle times. Invalid users return short errors or nothing.

Single User Query

Target specific usernames:

┌──(kali㉿kali)-[~]
└─$ finger $USERNAME@$TARGET_IP

Valid hit shows Login, Name, Directory, Shell, last login, and sometimes office/phone. Invalid returns "not known" or empty.

Common defaults to test:

┌──(kali㉿kali)-[~]
└─$ finger root@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ finger admin@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ finger test@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ finger guest@$TARGET_IP

Positive details guide credential attacks elsewhere.

List All Users

Dump everyone if allowed:

┌──(kali㉿kali)-[~]
└─$ finger @$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ finger ""@$TARGET_IP

Full user table appears on permissive servers. Extract fields:

┌──(kali㉿kali)-[~]
└─$ finger @$TARGET_IP | grep -E "Login|Name|Directory|Shell"

Reveals naming conventions and active accounts.

Manual Connection

Raw query for banner or leakage:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 79

Type username and enter. Empty first line sometimes dumps all users:

┌──(kali㉿kali)-[~]
└─$ echo "" | nc $TARGET_IP 79

Forwarding test for internal hosts:

┌──(kali㉿kali)-[~]
└─$ echo "user@internalhost" | nc $TARGET_IP 79

Success leaks internal names.

Automated Username Validation

Bash loop against wordlist:

for u in $(cat users.txt); do out=$(finger $u@@$TARGET_IP 2>/dev/null); [ -n "$out" ] && echo "$u: $out"; done

Non-empty output flags valid users.

Alternative grep filter:

for u in $(cat users.txt); do finger $u@@$TARGET_IP | grep -v "not known"; done

Pentestmonkey Finger Enum

Bulk validation:

┌──(kali㉿kali)-[~]
└─$ perl finger-user-enum.pl -U users.txt -t $TARGET_IP

Logs full output. Extract valids:

┌──(kali㉿kali)-[~]
└─$ grep "Login:" finger_enum_log.txt | cut -d ' ' -f 3

Fast for large lists on responsive services.

Nmap Finger Probes

Service version:

┌──(kali㉿kali)-[~]
└─$ nmap -p 79 -sV $TARGET_IP

Daemon details for vulnerability matching.

User info script:

┌──(kali㉿kali)-[~]
└─$ nmap -p 79 --script finger $TARGET_IP

Dumps available user details automatically.

References