Yahoo's /14 and an exposed phpinfo.php
Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php.
phpinfo()
Somebody left phpinfo.php on a production host and it prints the entire server config to anyone who asks.