[meow]

A few comments:

• /etc/p@sswd does not contain encrypted passwords unless you got access to a very, very, VERY outdated box (you are never going to find this). You are thinking of /etc/sh@dow, which can't be read without superuser privileges.
  
• there are SO many more things you can do with SSRF than read files
  
• "Unfortunately, 99% of admins will not change their default webroot directory." This is in most cases only true for servers which aren't hosting multiple websites, which is pretty rare nowadays. Even then, a lot of single-site hosts do change the default directory.
  

Other than that, nice tutorial.

This is for everyone - a lot of people believe the default php.ini setting for allow_url_fopen is 0 (disabled), which is only true for allow_url_include. If you see unsanitized output being passed to fopen() anywhere then take advantage of it.