I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is readable by www-data(apache2) user (e.g. the file with permission of rw-r--r--). This limits the usage of this hole since I can get /etc/passwd while I cannot download /etc/shadow. So My question is that what else valuable file can be downloaded under this restriction?
There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db.
Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, etc.