• Some web apps fetch files from server to display on the webpage
• Example: https://example.com/?include_file=file1.php
• This displays file1.php on the website.

If the admin doesn't whitelist what can be shown and what can't be you can include sensitive files like /etc/shadow showing all the hashed passwords stored on that server.

When a server includes a file, it read with the user's permission who requested it. A Root account can read everything.

• First include for something like robot.txt to see if it is vulnerable to read other files.

Try the following to exploit a server with LFI

• /etc/shadow - Shows hashed passwords of users
• server.js or index.js - If the server is running an app written with node.js these files lead to the source code which can reveal potential API Creds.
• /etc/hosts - To see if the server is communicating with other machines on the network.
• UPLOADS - /uploads/evil.php - If you upload a shell or exploit you can run it by including it like this.

NOTE:

You can't include a '/' inside a URL as the server will think you're requesting a new directory.

So in case if you include www.example.com/notes/?include=/etc/hosts , the server think you're asking for /notes/include/etc/shadow