This lesson illustrates the common problem of trusting a user-supplied filename, then using it to generate a file path. Try manipulating the get paramter and download WebGoat.NET's Web.config file!