Bruteforcing extensions

  • We can fuzz the extensions to find out which extensions are not blocked,

  • we will use burpsuite for this

Some useful extensions -

  • PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc

  • ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml

  • Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action

  • Coldfusion: .cfm, .cfml, .cfc, .dbm

  • Flash: .swf

  • Perl: .pl, .cgi

  • Erlang Yaws Web Server: .yaws

Now make list of extensions and add it to intruder to FUZZ and check out which one is worked

Note: Make sure url-encoding is unchecked in payload section, as it will unless encode our dot and we will not get desire results ,

PreviousBypass file upload filteringNextWebDAV

Last updated