Test LFI and Path Traversal

Look for users and try .ssh under /home/<USER>/.ssh/

If LFI is suspected, traverse paths to read sensitive files such as SSH keys or /etc/passwd. A hit is file contents returned in the response instead of the normal page—enumerate usernames from /etc/passwd and target /home/<USER>/.ssh/.