finger
finger is a user information lookup program and network protocol — one of the oldest on the Internet, standardized as RFC 1288 (The Finger User Information Protocol) in December 1991. The finger daemon (fingerd, historically listening on TCP/UDP port 79) answers queries about users: login name, full name, terminal, idle time, login time, office location, and contact details, plus the contents of the user’s ~/.plan and ~/.project files.
User enumeration
From a reconnaissance perspective, an exposed finger service is a user enumeration oracle. If fingerd is running, you can verify whether accounts exist and harvest information about them:
# Check whether a specific user exists on a host
finger $USER@$IP_ADDRESS
# List users currently logged in
finger @$IP_ADDRESSA successful response returns account details; a nonexistent user typically yields a no such user-style reply — the difference enables account guessing against a wordlist. On modern infrastructure finger is almost never exposed, but it appears regularly on legacy Unix hosts, older network devices, and CTF environments. The same disclosure concern drove most sites to disable it: RFC 1288 itself documents a security considerations section warning about information disclosure, and the 1988 Morris Worm famously exploited a buffer overflow in fingerd.
Modern replacements for this workflow are OSINT-driven — e.g. harvesting usernames/emails with theharvester and confirming addresses via confirm-gmail-address-existence — plus service-specific enumeration such as SMB user enumeration with nmap NSE scripts.