On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which do you grab first?
You only have the vulnerabilty at hand and nothing more of information (directory structure and similar is unknown at the point of compromise). The discovery and furter exploitation has to come from the file download vulnerability.
A few things come to mind:
- Source code. Potential information leaks about backends, configurations and so on.
- metabase.xml for IIS setups
- autoexec.bat incase there is anything juicy at startup