OWASP 2017 Java Sensitive data exposure

ok this is solved it wanted to get access of WEB-INF so when you try like below 

pass the query parameter file=web.xml&path=../WEB-INF/

you will get /var/lib/tomcat9 as response which is installation directory 

Can you please let me know answer of below question from the same lab?

What are the Http paramters necessary to upload a file? Enter them separated by a comma

What are the HTTP parameters necessary to upload a file

parameters are path,file

for the next question to you need to prepare URL like below, basically they want to understand how a hacker will gain access to unauthorized file

 <targetserver>?file=web.xml&path=../WEB-INF/

Once you run above URL in the browser you will get /var/lib/tomcat9 as response

I still dont understand why they are stuck up to servlets who the hell use them nowadays 

I agree

Thank you guys.