We’re given a website with an LFI vulnerability in its page parameter. This was used to leak index.php, and then subsequently bypass a check in the local file inclusion for the hardcoded '/etc/passwd' with '/etc/./passwd'.