title: Exploiting file_get_contents()
body: <p>Is it possible to read any file (not only those with the extension <em>.html</em>) from the server in the following script?</p>
  
  <pre><code>&lt;?php
  echo file_get_contents($_GET['display'].'.html');
  ?&gt;
  </code></pre>
  
  <p>I know about wrappers (<code>php://</code>, <code>file://</code>, etc.) but achieved not too much. </p>
  
  <p>I'm eager to hear all the possible vectors of attack.</p>
  
  <p>The PHP configuration is default:
  <code>allow_url_fopen On</code>, and let's assume the version is <code>&gt;= 7.0</code>, so null character <code>%00</code> doesn't work.</p>