One day, while testing the app's file-upload feature, Alex made a small mistake in the code. This mistake allowed the app to "look" outside its own folder. A curious visitor (or a malicious script) discovered this and used a string exactly like yours— ../../../../home/*/.aws/credentials
The payload is a URL-encoded attempt to exploit a Local File Inclusion (LFI) vulnerability. Its specific goal is to break out of a web application's intended directory and read the from the server's underlying operating system. If successful, this would grant an attacker the access keys and secret tokens required to take control of the victim's AWS infrastructure. Technical Breakdown
That’s why credentials is a crown jewel for attackers.
-file-../../../../home/*/.aws/credentials