First off, since your using IIS, did you set the Default Document value? This is usually the initial landing page Default Page that IIS assumes when there is no document referenced (like something.aspx) in a subdirectory.
In the long term you will need to create a "catch-all" rule that routes URL's to a specified processing file. In most URL program/libraries this should be the last rule in the list of rules.
If your URL design is clean you should never see the file extension in the address bar of the browser. You may see the page reference in the status bar of the browser but not in the address bar. As well, nothing you can do about people snooping with Dev Tools.