File Extension Discovery for upload

  1. Open up BURP and capture the upload site.

  2. Save it to a file.

  3. Modify the saved file.

  1. Run ffuf.

# options:
# -request: A saved file from BURP
# -request-proto:  Protocol to use along with raw request (default: https)
# -w: word file
# -fs: Filter the HTTP response 'size', comma separated. 
ffuf -request BURP/fuzz.req -request-proto http -w /opt/fuzz/filename_extention_list_no_dot.txt -fs 42,41

Last updated