Extension Fuzzing¶

Why Extension Fuzzing Matters¶

Before you can find specific pages on a web server, you need to know what file types the application serves. A PHP app serves .php files. A Java app might serve .jsp or use extensionless routing. An ASP.NET app uses .aspx. If you fuzz for pages without knowing the correct extension, you'll miss everything.

Extension fuzzing tells you the technology stack in seconds — and that knowledge drives every subsequent fuzzing step.

The Two Approaches¶

Approach 1: Using the -e Flag¶

The -e flag appends extensions to every word in the wordlist:

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ \
     -u http://SERVER_IP:PORT/blog/FUZZ -e .php,.html,.txt,.asp,.aspx,.jsp

This tests each word with every extension appended. For a word like index, it would try:

• http://SERVER_IP:PORT/blog/index
• http://SERVER_IP:PORT/blog/index.php
• http://SERVER_IP:PORT/blog/index.html
• http://SERVER_IP:PORT/blog/index.txt
• http://SERVER_IP:PORT/blog/index.asp
• http://SERVER_IP:PORT/blog/index.aspx
• http://SERVER_IP:PORT/blog/index.jsp

Approach 2: FUZZ in the Extension Position (Recommended First)¶

Use a dedicated extensions wordlist with FUZZ placed where the extension goes:

ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ \
     -u http://SERVER_IP:PORT/blog/indexFUZZ

This is a fast, targeted probe. The web-extensions.txt wordlist contains entries like:

.php
.html
.htm
.asp
.aspx
.jsp
.do
.action
.cgi
.pl
.txt
.xml
.json
.js
.css

Practical Walkthrough¶

Step 1: Identify Extensions on a Known Directory¶

Suppose from directory fuzzing you discovered /blog/. Now determine what files it serves:

ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ \
     -u http://10.10.10.5:8080/blog/indexFUZZ

________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.5:8080/blog/indexFUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/web-extensions.txt
 :: Threads          : 40
________________________________________________

.php                    [Status: 200, Size: 15842, Words: 3420, Lines: 312, Duration: 45ms]
.phps                   [Status: 403, Size: 289, Words: 21, Lines: 11, Duration: 39ms]

Interpretation:

• .php returned 200 with substantial content → the application is PHP-based
• .phps returned 403 → PHP source files exist but are forbidden (still useful info — phps can leak source code if misconfigured)
• No .html, .asp, .jsp → confirms this is not an ASP/Java stack

Step 2: Verify Against Multiple Directories¶

Don't assume the entire site uses one technology. Test against other discovered directories:

ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ \
     -u http://10.10.10.5:8080/admin/indexFUZZ

Interpreting Results¶

Chaining with Directory Results¶

Once you know the extension, feed that knowledge back into your directory fuzzing:

# You know it's PHP — now find PHP files across the site
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ \
     -u http://10.10.10.5:8080/FUZZ.php -fc 404

Or use the -e flag efficiently (only relevant extensions):

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ \
     -u http://10.10.10.5:8080/FUZZ -e .php -fc 404

Fuzzing for Backup Files¶

A common quick-win is combining known page names with backup extensions:

# Create a custom list of backup extensions
cat << 'EOF' > /tmp/backup-ext.txt
.bak
.old
.orig
.save
.swp
.swo
~
.copy
.tmp
.zip
.tar.gz
.gz
EOF

# Fuzz against known files
ffuf -w /tmp/backup-ext.txt:FUZZ \
     -u http://10.10.10.5:8080/admin/config.phpFUZZ

Multiple Extension Probing in One Shot¶

If you want to test a broader set of filenames × extensions in one command:

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt:FILE \
     -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:EXT \
     -u http://10.10.10.5:8080/FILE.EXT -fc 404 -t 100

➡️ Next: Page Fuzzing — discover actual files within directories