I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is readable by www-data(apache2) user (e.g. the file with permission of rw-r--r--). This limits the usage of this hole since I can get /etc/passwd while I cannot download /etc/shadow. So My question is that what else valuable file can be downloaded under this restriction?
closed as primarily opinion-based by Steffen Ullrich, Tobi Nary, Neil Smithline, Matthew, M'vy Apr 25 '16 at 9:13
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db.
Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, etc.