# File Extension Discovery for upload

1. Open up BURP and capture the upload site.&#x20;
2. Save it to a file.&#x20;
3. Modify the saved file.

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FTQhGMjkzWuN8niusDWDH%2Fimage.png?alt=media&#x26;token=10f4969e-b935-4d6c-aa99-e851fff88a3b" alt=""><figcaption></figcaption></figure>

1. Run ffuf.&#x20;

{% code overflow="wrap" %}
```bash
# options:
# -request: A saved file from BURP
# -request-proto:  Protocol to use along with raw request (default: https)
# -w: word file
# -fs: Filter the HTTP response 'size', comma separated. 
ffuf -request BURP/fuzz.req -request-proto http -w /opt/fuzz/filename_extention_list_no_dot.txt -fs 42,41

```
{% endcode %}

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FCCrBEln8iiLBxlbqmYXl%2Fimage.png?alt=media&#x26;token=98106360-56d0-47f9-ba59-6414655a48df" alt=""><figcaption></figcaption></figure>
