php is a script programming language that allows the web server to run programs for the client and send back the results. For it to be exploitable in the way your course expects get.php contains a PHP script something like <?php echo file_get_contents($_GET['file']); php is truly a great language for writing exploits. The shorter <?php system("cat $_GET[file]"); does the same gets you a shell injection too.