Port 79 – FINGER (Finger Protocol)

Port 79 is the default port for Finger, a protocol that answers “who is on this host and what are they doing” over cleartext TCP. Query it and a finger daemon hands back logged-in users, real names, login and idle times, home directory, login shell, and whatever the user left in their .plan and .project files. It’s a relic of pre-web Unix, but you still trip over it on old servers and network gear — and when you do, it’s a free user list.

Why It’s Open

Finger dates to the era when a shared Unix box was a social space and you’d finger a colleague to see if they were logged in. That world is gone, so on anything modern you should be looking at SSH on port 22, not a finger daemon. Where 79 still answers, it’s almost always legacy: old Solaris and BSD hosts running in.fingerd, HP-UX boxes, some network appliances and print servers that bundled it, and forgotten machines kept alive for one internal tool. A live port 79 is a strong signal the host hasn’t been touched in years — which usually means the rest of its stack is stale too.

Common Risks

• Free user enumeration. finger @host often dumps every account currently logged in, and finger root@host confirms specific names. That list feeds straight into password spraying on SSH, SMTP, or any other login on the box — no brute-force needed to learn who exists.
• Finger redirection (bounce). Many daemons honour finger user@hostA@hostB, relaying the query through hostA to hostB. Attackers used it to bounce recon through a trusted intermediary and hide the real source, the same idea as an FTP bounce.
• Personal detail for social engineering. Real names, phone numbers, office locations, and login patterns pulled from finger and .plan files are exactly what a convincing phishing pretext is built from.
• Historic pre-auth RCE. Older fingerd and cfingerd builds have remotely exploitable memory-corruption and format-string bugs — the class of flaw that launched the Morris Worm and still lingers on unpatched legacy hosts.
• Info leaked from .plan/.project. Whatever a user parked in those files — schedules, internal hostnames, project notes — finger will serve to anyone who asks.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and grab the banner

nmap -sV -p 79 --script finger <target>

List everyone currently logged in

finger @<target>

Query a specific user

finger root@<target>
finger admin@<target>

Raw connection with netcat

nc -nv <target> 79

Send an empty line to list all users, or type a username and press enter to query one — handy when the local finger client isn’t installed.

Test finger redirection (bounce)

finger @intermediate@<target>

If the intermediate host relays the query, the daemon is vulnerable to bounce recon.

Metasploit user enumeration

msfconsole -q
use auxiliary/scanner/finger/finger_users
set RHOSTS <target>
set USERS_FILE /usr/share/wordlists/metasploit/unix_users.txt
run

Keep every valid username the daemon hands back — drop it straight into the pentest report so the account list is ready to reuse when you pivot to SSH or SMTP.

What to Look For

Known CVEs and Exploits

• Morris Worm (1988) — a stack overflow in the BSD fingerd, which read network input into a fixed buffer with gets(), gave the first internet worm remote code execution. The original class of finger bug and still the reference PoC (Exploit-DB).
• CVE-2013-1049 — buffer overflow in the RFC1413 (ident) client of cfingerd 1.4.3-3. cfingerd fires an ident query back at whoever connects, so a malicious identd that answers with more than 96 bytes corrupts the stack — a crash and possible code execution, triggered just by fingering the server (Debian DSA-2635-1).
• cfingerd 1.4 format string — cfingerd logged the remote username without sanitising it, so a client that returns format specifiers instead of a name gained root, since the daemon ran as root (Debian DSA-066-1, PoC on Exploit-DB).
• CVE-1999-0612 — not code execution but the reason finger is a finding at all: a daemon exposing valid user information to anyone on the network. It’s classed as a configuration issue, and the fix is to stop running it.

Mitigation

• Turn it off. There’s no encrypted or hardened version of Finger to move to — disable and uninstall fingerd / in.fingerd / cfingerd, and remove it from inetd/xinetd or systemd.
• Firewall TCP/79 so nothing outside a trusted range can reach it on any host that must keep it briefly.
• Restrict with TCP wrappers via hosts.allow / hosts.deny where the daemon supports them.
• Strip .plan and .project of anything sensitive if finger genuinely can’t be removed yet.
• Rescan to confirm — nmap -p 79 <target> should show the port closed after the change.

Real-World Example

In November 1988 the Morris Worm became the first malware to spread across the internet, and one of its main vectors was a buffer overflow in the BSD fingerd: it sent an over-long string that overran the daemon’s input buffer and executed its own code. The worm hit roughly 6,000 machines — about 10% of the internet at the time — clogged networks for days, produced the first conviction under the US Computer Fraud and Abuse Act, and led directly to the creation of the CERT Coordination Center. Nearly four decades on, an exposed finger daemon is still the same idea: an unauthenticated service handing out exactly what an attacker needs.

FAQ

What is port 79 used for?

Port 79 is the default port for the Finger protocol, a legacy Unix service that reports who is logged into a host along with their real name, login and idle times, home directory, and .plan file contents. It runs in cleartext over TCP and has been obsolete since SSH replaced this style of remote lookup.

Is port 79 dangerous?

On any untrusted network, yes. The finger service hands valid usernames and personal details to anyone who asks — ideal fuel for password spraying and social engineering — and older fingerd/cfingerd builds carry remotely exploitable overflows. Treat an exposed port 79 as something to close, not to harden.

What service runs on port 79?

A finger daemon — fingerd or in.fingerd on BSD/Solaris, or the configurable cfingerd on Linux. It’s closely related to Ident on port 113, another old service whose whole job is disclosing user identity.

How do I close port 79?

Disable and uninstall the finger daemon, then remove its entry from inetd/xinetd or its systemd unit; there’s no secure replacement to switch to, so the correct state is off. Firewall TCP/79 in the meantime and rescan with nmap -p 79 <target> to confirm it’s closed.

TL;DR

• Service: Finger (user information lookup, fingerd/cfingerd)
• Default port: 79/TCP, cleartext
• Biggest risk: free user enumeration and personal-detail disclosure, plus historic pre-auth RCE in old daemons
• Mitigation: disable and uninstall it — there’s no secure version — and firewall TCP/79