> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/web-attacks/file-upload/file-extension-discovery-for-upload.md).
# File Extension Discovery for upload
1. Open up BURP and capture the upload site.
2. Save it to a file.
3. Modify the saved file.
1. Run ffuf.
{% code overflow="wrap" %}
```bash
# options:
# -request: A saved file from BURP
# -request-proto: Protocol to use along with raw request (default: https)
# -w: word file
# -fs: Filter the HTTP response 'size', comma separated.
ffuf -request BURP/fuzz.req -request-proto http -w /opt/fuzz/filename_extention_list_no_dot.txt -fs 42,41
```
{% endcode %}
