In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always something well known such as these:
/etc/passwd /etc/shadow .htaccess .htpasswd ../admin/.htpasswd /proc/self/environ
Sometimes the name of the file to include is very hard to guess and unpredictable. Hence, I am asking if there is a technical method to know the right name of the file that can save us the time of guessing.